From 8e0ff6aff5a6b41a4eaf5d5bfdeb063791ea6c14 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:01:09 +0200
Subject: [PATCH 01/86] feat: add bucket encryption requests

---
 src/lib/api.ts                       |   2 +
 src/lib/api/bucketCompression.ts     |  21 ++
 src/lib/api/bucketEncryption.test.ts | 105 +++++++++
 src/lib/api/bucketEncryption.ts      | 324 +++++++++++++++++++++++++++
 4 files changed, 452 insertions(+)
 create mode 100644 src/lib/api/bucketCompression.ts
 create mode 100644 src/lib/api/bucketEncryption.test.ts
 create mode 100644 src/lib/api/bucketEncryption.ts

diff --git a/src/lib/api.ts b/src/lib/api.ts
index c7f46a4b..de01f71a 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -15,6 +15,8 @@ export * from './api/connectors'
 export * from './api/staging'
 export * from './api/storageRouting'
 export * from './api/bucketUsage'
+export * from './api/bucketCompression'
+export * from './api/bucketEncryption'
 export * from './api/blobs'
 export * from './api/sync'
 export * from './api/notifications'
diff --git a/src/lib/api/bucketCompression.ts b/src/lib/api/bucketCompression.ts
new file mode 100644
index 00000000..fe4d67e0
--- /dev/null
+++ b/src/lib/api/bucketCompression.ts
@@ -0,0 +1,21 @@
+// ── Bucket compression (GET /data/buckets/{bucket}/storage/compression) ────
+// Node-local, asked of the bucket's own node. An encrypted bucket compresses
+// inside Pithos at the nearest supported level, which `effective_level` names.
+import { apiRequest, type ApiClientOptions } from './client'
+
+export interface BucketCompressionResponse {
+  bucket: string
+  mode: 'off' | 'zstd'
+  /** The requested zstd level; present only with `zstd`. */
+  level?: number
+  /** The zstd level Pithos applies in an encrypted bucket; absent when not reported. */
+  effective_level?: number
+}
+
+export function getBucketCompression(
+  bucket: string,
+  client: ApiClientOptions,
+  signal?: AbortSignal,
+): Promise<BucketCompressionResponse> {
+  return apiRequest(`/data/buckets/${encodeURIComponent(bucket)}/storage/compression`, { signal }, client)
+}
diff --git a/src/lib/api/bucketEncryption.test.ts b/src/lib/api/bucketEncryption.test.ts
new file mode 100644
index 00000000..a50f7504
--- /dev/null
+++ b/src/lib/api/bucketEncryption.test.ts
@@ -0,0 +1,105 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ApiError } from './client'
+import {
+  bucketLocked,
+  extendUnlock,
+  getMyCopies,
+  lockBucket,
+  removeBucketHolder,
+  unlockBucket,
+} from './bucketEncryption'
+
+const NODE = { baseUrl: 'https://node-b.test/api/v1', token: 'bearer-1' }
+
+interface Call {
+  url: URL
+  method: string
+  contentType: string | null
+  body: unknown
+}
+
+function stubFetch(payload: unknown, status = 200, code?: string) {
+  const calls: Call[] = []
+  vi.stubGlobal('window', { location: { origin: 'https://portal.test' } })
+  vi.stubGlobal('fetch', vi.fn(async (input: URL, init: RequestInit) => {
+    calls.push({
+      url: new URL(String(input)),
+      method: init.method ?? 'GET',
+      contentType: new Headers(init.headers).get('Content-Type'),
+      body: init.body,
+    })
+    if (status === 204) return new Response(null, { status })
+    return new Response(JSON.stringify(code ? { error: 'refused', code } : payload), { status })
+  }))
+  return calls
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+const UNLOCKED = { state: 'unlocked', session_id: 'S1', deadline_ms: 2_000 }
+
+describe('bucket encryption client', () => {
+  it('sends the key as 32 binary bytes and the other fields in the query', async () => {
+    const calls = stubFetch(UNLOCKED)
+    const key = new Uint8Array(32).fill(7)
+
+    const status = await unlockBucket('reef', { bucket_id: 'B1', generation: 3, duration_ms: 60_000 }, key, NODE)
+
+    expect(status).toEqual(UNLOCKED)
+    expect(calls[0].url.origin + calls[0].url.pathname).toBe(
+      'https://node-b.test/api/v1/data/buckets/reef/storage/encryption/unlock',
+    )
+    expect(Object.fromEntries(calls[0].url.searchParams)).toEqual({ bucket_id: 'B1', generation: '3', duration_ms: '60000' })
+    expect(calls[0].method).toBe('POST')
+    expect(calls[0].contentType).toBe('application/octet-stream')
+    expect(calls[0].body).toBe(key)
+  })
+
+  it('refuses a key of another length before sending anything', async () => {
+    const calls = stubFetch(UNLOCKED)
+
+    await expect(unlockBucket('reef', { bucket_id: 'B1', generation: 3 }, new Uint8Array(31), NODE)).rejects.toThrow(
+      '32 bytes',
+    )
+    expect(calls).toHaveLength(0)
+  })
+
+  it('names the session to extend and locks without a body', async () => {
+    const calls = stubFetch(UNLOCKED)
+
+    await extendUnlock('reef', { session_id: 'S1', duration_ms: 5_000 }, NODE)
+    await lockBucket('reef', NODE)
+
+    expect(calls[0].url.pathname).toBe('/api/v1/data/buckets/reef/storage/encryption/extend')
+    expect(JSON.parse(String(calls[0].body))).toEqual({ session_id: 'S1', duration_ms: 5_000 })
+    expect(calls[1].url.pathname).toBe('/api/v1/data/buckets/reef/storage/encryption/lock')
+    expect(calls[1].body).toBeUndefined()
+  })
+
+  it('asks for the copies of one generation and removes a holder with the observed revision', async () => {
+    const calls = stubFetch({ copies: [] })
+
+    await getMyCopies('reef', 4, NODE)
+    const removal = stubFetch(null, 204)
+    await removeBucketHolder('reef', 'U1@realm', 'rev-2', true, NODE)
+    await removeBucketHolder('reef', 'U1@realm', 'rev-2', false, NODE)
+
+    expect(calls[0].url.searchParams.get('generation')).toBe('4')
+    expect(removal[0].url.pathname).toBe('/api/v1/data/buckets/reef/storage/encryption/holders/U1%40realm')
+    expect(Object.fromEntries(removal[0].url.searchParams)).toEqual({ revision: 'rev-2', confirm_recovery: 'true' })
+    expect(Object.fromEntries(removal[1].url.searchParams)).toEqual({ revision: 'rev-2' })
+  })
+
+  it('tells a locked bucket from other conflicts', async () => {
+    stubFetch(null, 409, 'bucket_locked')
+    const locked = await getMyCopies('reef', 1, NODE).catch((error: unknown) => error)
+    stubFetch(null, 409, 'stale_generation')
+    const stale = await getMyCopies('reef', 1, NODE).catch((error: unknown) => error)
+
+    expect(locked).toBeInstanceOf(ApiError)
+    expect(bucketLocked(locked)).toBe(true)
+    expect(bucketLocked(stale)).toBe(false)
+  })
+})
diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
new file mode 100644
index 00000000..e6941ea9
--- /dev/null
+++ b/src/lib/api/bucketEncryption.ts
@@ -0,0 +1,324 @@
+// ── Bucket encryption (/data/buckets/{bucket}/storage/encryption) ──────────
+// Node-local: every request goes to the API base of the node hosting the bucket,
+// never through S3. An older node answers 404: "not reported here", never "off".
+import { ApiError, apiRequest, type ApiClientOptions } from './client'
+
+export type EncryptionMode = 'off' | 'node_managed' | 'vault_locked'
+export type BlockCipher = 'chacha20_poly1305' | 'aes256_gcm'
+export type BlockKeys = 'content_derived' | 'unique'
+/** Why a bucket is locked: a holder locked it, its timed unlock ended, or the node restarted. */
+export type LockReason = 'manual' | 'timed' | 'restart'
+
+export interface BucketUnlockStatus {
+  state: 'locked' | 'unlocked'
+  /** Null while unlocked, and for a bucket that has not been locked since it was created. */
+  lock_reason: LockReason | null
+  locked_at_ms: number | null
+  /** The unlock session an extension must name; null while locked. */
+  session_id: string | null
+  unlocked_at_ms: number | null
+  /** End of a timed unlock; null means until lock or restart. */
+  deadline_ms: number | null
+  /** The latest end an extension may reach, from the bucket maximum; null without one. */
+  max_deadline_ms: number | null
+}
+
+/** Distinct users per holder state for the active key generation. Null counts are unknown. */
+export interface HolderReadiness {
+  ready: number | null
+  pending: number | null
+  /** Holders whose user key the directory lacks or did not return. */
+  missing_key: number | null
+}
+
+/**
+ * `met`: two ready holders, or one whose directory record declares a recovery code.
+ * `unknown`: the key directory did not answer, so the rule could not be checked.
+ */
+export interface RecoveryStatus {
+  state: 'met' | 'degraded' | 'unknown'
+  ready_holders: number | null
+  ready_with_recovery: number | null
+}
+
+export type TransitionKind = 'encrypt' | 'decrypt' | 'reencode' | 'rotate'
+export type TransitionState = 'running' | 'awaiting_key' | 'cleanup' | 'blocked' | 'finished'
+
+/** This node's rewrite of stored versions after a mode change, a format change or a rotation. */
+export interface EncryptionTransition {
+  kind: TransitionKind
+  state: TransitionState
+  source_generation: number | null
+  target_generation: number | null
+  /** Versions already written in the target form. */
+  done: number
+  /** Versions still to rewrite; null while the node has not counted them. */
+  remaining: number | null
+  failed: number
+  /** Old copies still to remove; the change is complete only when this reaches zero. */
+  cleanup_remaining: number | null
+  started_at_ms: number
+  finished_at_ms: number | null
+  /** Why the work cannot go on, such as a backend that keeps old copies. */
+  blocked_reason: string | null
+}
+
+/** What the caller may do on this bucket. */
+export interface EncryptionCaller {
+  /** Current key holder: creator, group admin or explicit grant. */
+  holder: boolean
+  /** Has a ready sealed copy of the active generation. */
+  ready_copy: boolean
+  /** Group-admin WRITE: settings, holders and rotation. */
+  admin: boolean
+}
+
+export interface BucketEncryptionResponse {
+  bucket: string
+  mode: EncryptionMode
+  /** Stable id the bucket keys bind to; null until encryption was first enabled. */
+  bucket_id: string | null
+  storage_generation: number
+  /** Generation new writes seal to; zero until the first key exists. */
+  key_generation: number
+  /** Standard base64 of the 32-byte X25519 public key of the active generation. */
+  public_key: string | null
+  /** Lowercase hex SHA-256 of the public key. */
+  fingerprint: string | null
+  cipher: BlockCipher
+  block_keys: BlockKeys
+  /** Longest unlock a holder may ask for; null means until lock or restart. */
+  max_unlock_ms: number | null
+  /** Null while encryption is off. */
+  unlock: BucketUnlockStatus | null
+  holders: HolderReadiness | null
+  recovery: RecoveryStatus | null
+  transition: EncryptionTransition | null
+  caller: EncryptionCaller
+}
+
+export interface PutBucketEncryptionRequest {
+  mode: EncryptionMode
+  cipher?: BlockCipher
+  block_keys?: BlockKeys
+  /** Null removes the maximum; absent keeps it. */
+  max_unlock_ms?: number | null
+  /** The key generation the caller saw; another current one is a 409 `stale_generation`. */
+  expected_generation: number
+}
+
+/** The non-secret unlock fields. The 32 key bytes travel as the binary body. */
+export interface UnlockBucketRequest {
+  bucket_id: string
+  generation: number
+  /** Absent means the bucket maximum, or until lock or restart without one. */
+  duration_ms?: number
+}
+
+export interface ExtendUnlockRequest {
+  session_id: string
+  /** Measured from now; absent means the bucket maximum, or until lock or restart. */
+  duration_ms?: number
+}
+
+export type HolderOrigin = 'creator' | 'admin' | 'explicit'
+/** `missing_key`: no usable user key in the directory. `unavailable`: the directory did not answer. */
+export type HolderState = 'ready' | 'pending' | 'missing_key' | 'unavailable'
+
+export interface BucketHolderEntry {
+  user_id: string
+  name?: string | null
+  origin: HolderOrigin
+  state: HolderState
+  /** From the user's key directory record; null when unknown. */
+  has_recovery: boolean | null
+  granted_by: string | null
+  granted_at_ms: number | null
+}
+
+export interface BucketHoldersResponse {
+  holders: BucketHolderEntry[]
+  recovery: RecoveryStatus
+  /** Opaque revision of the holder set; a removal names it so a changed set is refused. */
+  revision: string
+}
+
+/** A bucket private key sealed with HPKE to one of the caller's user keys. */
+export interface SealedCopyEntry {
+  bucket_id: string
+  generation: number
+  /** The key directory record the copy is sealed to. */
+  key_record: string
+  /** The vault keypair id of that record. */
+  key_id: string
+  /** Standard base64 of the 32-byte encapsulated key. */
+  enc: string
+  /** Standard base64 of the AES-256-GCM ciphertext. */
+  ciphertext: string
+  created_at_ms: number
+}
+
+export interface SealedCopiesResponse {
+  copies: SealedCopyEntry[]
+}
+
+export interface BucketAuditEvent {
+  event_id: string
+  at_ms: number
+  /** unlock, extend, lock, timed_lock, restart_lock, mode_change, holder_grant, holder_remove, rotate. */
+  action: string
+  /** Null for the node itself, such as a timed or restart lock. */
+  actor_user_id: string | null
+  node_id: string
+  generation: number | null
+  deadline_ms: number | null
+  reason: string | null
+  /** applied, intent (no outcome recorded) or failed. */
+  outcome: string
+}
+
+export interface BucketAuditResponse {
+  events: BucketAuditEvent[]
+  /** Opaque; omitted on the last page. */
+  next_cursor?: string
+}
+
+export const BUCKET_KEY_BYTES = 32
+
+/** Machine-readable codes of the encryption routes. */
+export const ENCRYPTION_CODES = {
+  locked: 'bucket_locked',
+  wrongKey: 'wrong_key',
+  invalidDuration: 'invalid_duration',
+  staleGeneration: 'stale_generation',
+  openUploads: 'open_uploads',
+  sessionMismatch: 'session_mismatch',
+  staleHolders: 'stale_holders',
+  confirmRecovery: 'recovery_confirmation_required',
+  recoveryUnmet: 'recovery_unmet',
+  capacity: 'unlock_capacity',
+} as const
+
+function base(bucket: string): string {
+  return `/data/buckets/${encodeURIComponent(bucket)}/storage/encryption`
+}
+
+/** True when the node refused because the bucket is locked. */
+export function bucketLocked(error: unknown): boolean {
+  return encryptionRefusal(error, 409, ENCRYPTION_CODES.locked)
+}
+
+export function encryptionRefusal(error: unknown, status: number, code: string): boolean {
+  return error instanceof ApiError && error.status === status && error.code === code
+}
+
+export function getBucketEncryption(
+  bucket: string,
+  client: ApiClientOptions,
+  signal?: AbortSignal,
+): Promise<BucketEncryptionResponse> {
+  return apiRequest(base(bucket), { signal }, client)
+}
+
+export function putBucketEncryption(
+  bucket: string,
+  request: PutBucketEncryptionRequest,
+  client: ApiClientOptions,
+): Promise<BucketEncryptionResponse> {
+  return apiRequest(base(bucket), { method: 'PUT', body: JSON.stringify(request) }, client)
+}
+
+/** Sends exactly the 32 key bytes as the body; the caller clears its buffer afterwards. */
+export function unlockBucket(
+  bucket: string,
+  request: UnlockBucketRequest,
+  key: Uint8Array<ArrayBuffer>,
+  client: ApiClientOptions,
+): Promise<BucketUnlockStatus> {
+  if (key.length !== BUCKET_KEY_BYTES) {
+    return Promise.reject(new Error('A bucket key has exactly 32 bytes.'))
+  }
+  return apiRequest(
+    `${base(bucket)}/unlock`,
+    {
+      method: 'POST',
+      body: key,
+      headers: { 'Content-Type': 'application/octet-stream' },
+      query: { ...request },
+    },
+    client,
+  )
+}
+
+export function extendUnlock(
+  bucket: string,
+  request: ExtendUnlockRequest,
+  client: ApiClientOptions,
+): Promise<BucketUnlockStatus> {
+  return apiRequest(`${base(bucket)}/extend`, { method: 'POST', body: JSON.stringify(request) }, client)
+}
+
+export function lockBucket(bucket: string, client: ApiClientOptions): Promise<BucketUnlockStatus> {
+  return apiRequest(`${base(bucket)}/lock`, { method: 'POST' }, client)
+}
+
+export function listBucketHolders(
+  bucket: string,
+  client: ApiClientOptions,
+  signal?: AbortSignal,
+): Promise<BucketHoldersResponse> {
+  return apiRequest(`${base(bucket)}/holders`, { signal }, client)
+}
+
+export function grantBucketHolder(
+  bucket: string,
+  userId: string,
+  client: ApiClientOptions,
+): Promise<BucketHolderEntry> {
+  return apiRequest(`${base(bucket)}/holders`, { method: 'POST', body: JSON.stringify({ user_id: userId }) }, client)
+}
+
+/** `confirmRecovery` accepts that the removal breaks the recovery rule. */
+export function removeBucketHolder(
+  bucket: string,
+  userId: string,
+  revision: string,
+  confirmRecovery: boolean,
+  client: ApiClientOptions,
+): Promise<void> {
+  return apiRequest(
+    `${base(bucket)}/holders/${encodeURIComponent(userId)}`,
+    { method: 'DELETE', query: { revision, confirm_recovery: confirmRecovery || undefined } },
+    client,
+  )
+}
+
+export function getMyCopies(
+  bucket: string,
+  generation: number,
+  client: ApiClientOptions,
+  signal?: AbortSignal,
+): Promise<SealedCopiesResponse> {
+  return apiRequest(`${base(bucket)}/copies/me`, { signal, query: { generation } }, client)
+}
+
+export function rotateBucketKey(
+  bucket: string,
+  expectedGeneration: number,
+  client: ApiClientOptions,
+): Promise<BucketEncryptionResponse> {
+  return apiRequest(
+    `${base(bucket)}/rotate`,
+    { method: 'POST', body: JSON.stringify({ expected_generation: expectedGeneration }) },
+    client,
+  )
+}
+
+export function getBucketAudit(
+  bucket: string,
+  client: ApiClientOptions,
+  page: { limit?: number; cursor?: string } = {},
+  signal?: AbortSignal,
+): Promise<BucketAuditResponse> {
+  return apiRequest(`${base(bucket)}/audit`, { signal, query: { ...page } }, client)
+}

From 4a571aa1077d1357c93a4656fee4266312bdcf3f Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:02:59 +0200
Subject: [PATCH 02/86] feat: await the vault key check and require twelve
 characters

---
 .../settings/VaultCreateForm.test.ts          |  5 +-
 src/components/settings/VaultCreateForm.vue   |  9 +--
 src/components/settings/VaultSettings.test.ts | 14 ++--
 src/components/settings/VaultSettings.vue     |  6 +-
 src/composables/useUserVault.test.ts          | 67 +++++++++++++++----
 src/composables/useUserVault.ts               | 33 ++++++++-
 6 files changed, 104 insertions(+), 30 deletions(-)

diff --git a/src/components/settings/VaultCreateForm.test.ts b/src/components/settings/VaultCreateForm.test.ts
index dec2f68c..4258811e 100644
--- a/src/components/settings/VaultCreateForm.test.ts
+++ b/src/components/settings/VaultCreateForm.test.ts
@@ -43,7 +43,7 @@ const VaultCreateForm = compileClientComponent(new URL('./VaultCreateForm.vue',
   '@/components/ui/Input.vue': moduleDefault(InputStub),
   '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
   '@/composables/useUserVault': { useUserVault: () => ({ create }) },
-  '@/lib/vault/crypto': { MIN_PASSPHRASE_LENGTH: 8 },
+  '@/lib/vault/crypto': { MIN_KEY_HOLDER_PASSPHRASE_LENGTH: 12 },
   '@/lib/utils': { errorMessage },
 })
 
@@ -70,6 +70,9 @@ describe('VaultCreateForm', () => {
     await fill(root, 'short', 'short')
     expect(button(root, 'Create').props.disabled).toBe(true)
 
+    await fill(root, 'eleven char')
+    expect(button(root, 'Create').props.disabled).toBe(true)
+
     await fill(root, 'correct horse', 'correct house')
     expect(button(root, 'Create').props.disabled).toBe(true)
 
diff --git a/src/components/settings/VaultCreateForm.vue b/src/components/settings/VaultCreateForm.vue
index ae387934..a7d30c21 100644
--- a/src/components/settings/VaultCreateForm.vue
+++ b/src/components/settings/VaultCreateForm.vue
@@ -7,7 +7,7 @@ import CopyButton from '@/components/ui/CopyButton.vue'
 import Input from '@/components/ui/Input.vue'
 import Notice from '@/components/ui/Notice.vue'
 import { useUserVault } from '@/composables/useUserVault'
-import { MIN_PASSPHRASE_LENGTH } from '@/lib/vault/crypto'
+import { MIN_KEY_HOLDER_PASSPHRASE_LENGTH } from '@/lib/vault/crypto'
 import { errorMessage } from '@/lib/utils'
 
 const emit = defineEmits<{ (e: 'done'): void }>()
@@ -20,10 +20,10 @@ const busy = ref(false)
 const failure = ref<string | null>(null)
 const recoveryCode = ref<string | null>(null)
 
-const tooShort = computed(() => passphrase.value.length > 0 && passphrase.value.length < MIN_PASSPHRASE_LENGTH)
+const tooShort = computed(() => passphrase.value.length > 0 && passphrase.value.length < MIN_KEY_HOLDER_PASSPHRASE_LENGTH)
 const mismatch = computed(() => repeat.value.length > 0 && repeat.value !== passphrase.value)
 const canCreate = computed(() =>
-  passphrase.value.length >= MIN_PASSPHRASE_LENGTH && repeat.value === passphrase.value && !busy.value)
+  passphrase.value.length >= MIN_KEY_HOLDER_PASSPHRASE_LENGTH && repeat.value === passphrase.value && !busy.value)
 
 async function submit() {
   if (!canCreate.value) return
@@ -66,7 +66,7 @@ async function submit() {
           type="password"
           class="mt-1.5"
           autocomplete="new-password"
-          :placeholder="`At least ${MIN_PASSPHRASE_LENGTH} characters`"
+          :placeholder="`At least ${MIN_KEY_HOLDER_PASSPHRASE_LENGTH} characters`"
           :invalid="tooShort ? 'error' : undefined"
           @keydown.enter.prevent="submit"
         />
@@ -91,6 +91,7 @@ async function submit() {
     </label>
     <p class="text-xs text-muted-foreground">
       The passphrase never leaves this browser. Without it, or the recovery code, the keys on the node cannot be opened again.
+      It needs {{ MIN_KEY_HOLDER_PASSPHRASE_LENGTH }} characters because the same vault opens encrypted buckets.
     </p>
     <Notice v-if="failure" tone="error">{{ failure }}</Notice>
     <div class="flex justify-end">
diff --git a/src/components/settings/VaultSettings.test.ts b/src/components/settings/VaultSettings.test.ts
index 0e19cb5f..af16876d 100644
--- a/src/components/settings/VaultSettings.test.ts
+++ b/src/components/settings/VaultSettings.test.ts
@@ -57,7 +57,7 @@ const VaultSettings = compileClientComponent(new URL('./VaultSettings.vue', impo
   './VaultUnlockForm.vue': moduleDefault(UnlockStub),
   './VaultCreateForm.vue': moduleDefault(CreateStub),
   '@/composables/useUserVault': { useUserVault: () => ({ state, error, lock, changePassphrase, reset }) },
-  '@/lib/vault/crypto': { MIN_PASSPHRASE_LENGTH: 8 },
+  '@/lib/vault/crypto': { MIN_KEY_HOLDER_PASSPHRASE_LENGTH: 12 },
   '@/lib/utils': { errorMessage },
 })
 
@@ -118,12 +118,12 @@ describe('VaultSettings', () => {
     const box = dialog(root)
 
     await typeValue(field(box, 'vault-current'), 'old horse')
-    await typeValue(field(box, 'vault-next'), 'new horse!')
+    await typeValue(field(box, 'vault-next'), 'new horse battery')
     expect(button(box, 'Change passphrase').props.disabled).toBe(true)
-    await typeValue(field(box, 'vault-next-repeat'), 'new horse!')
+    await typeValue(field(box, 'vault-next-repeat'), 'new horse battery')
     await click(button(box, 'Change passphrase'))
 
-    expect(changePassphrase).toHaveBeenCalledWith({ passphrase: 'old horse' }, 'new horse!')
+    expect(changePassphrase).toHaveBeenCalledWith({ passphrase: 'old horse' }, 'new horse battery')
     expect(() => dialog(root)).toThrow()
   })
 
@@ -133,11 +133,11 @@ describe('VaultSettings', () => {
     await click(button(dialog(root), 'Use the recovery code'))
 
     await typeValue(field(dialog(root), 'vault-current'), 'ABCD-EFGH')
-    await typeValue(field(dialog(root), 'vault-next'), 'new horse!')
-    await typeValue(field(dialog(root), 'vault-next-repeat'), 'new horse!')
+    await typeValue(field(dialog(root), 'vault-next'), 'new horse battery')
+    await typeValue(field(dialog(root), 'vault-next-repeat'), 'new horse battery')
     await click(button(dialog(root), 'Change passphrase'))
 
-    expect(changePassphrase).toHaveBeenCalledWith({ recoveryCode: 'ABCD-EFGH' }, 'new horse!')
+    expect(changePassphrase).toHaveBeenCalledWith({ recoveryCode: 'ABCD-EFGH' }, 'new horse battery')
   })
 
   it('names what a reset loses before deleting the keys', async () => {
diff --git a/src/components/settings/VaultSettings.vue b/src/components/settings/VaultSettings.vue
index 8a4300ac..485e3125 100644
--- a/src/components/settings/VaultSettings.vue
+++ b/src/components/settings/VaultSettings.vue
@@ -15,7 +15,7 @@ import Notice from '@/components/ui/Notice.vue'
 import VaultCreateForm from './VaultCreateForm.vue'
 import VaultUnlockForm from './VaultUnlockForm.vue'
 import { useUserVault } from '@/composables/useUserVault'
-import { MIN_PASSPHRASE_LENGTH } from '@/lib/vault/crypto'
+import { MIN_KEY_HOLDER_PASSPHRASE_LENGTH } from '@/lib/vault/crypto'
 import { errorMessage } from '@/lib/utils'
 
 const { state, error, lock, changePassphrase, reset } = useUserVault()
@@ -31,7 +31,7 @@ const failure = ref<string | null>(null)
 
 const canChange = computed(() =>
   current.value.trim().length > 0
-  && next.value.length >= MIN_PASSPHRASE_LENGTH
+  && next.value.length >= MIN_KEY_HOLDER_PASSPHRASE_LENGTH
   && repeat.value === next.value
   && !busy.value)
 
@@ -155,7 +155,7 @@ async function confirmReset() {
               type="password"
               class="mt-1.5"
               autocomplete="new-password"
-              :placeholder="`At least ${MIN_PASSPHRASE_LENGTH} characters`"
+              :placeholder="`At least ${MIN_KEY_HOLDER_PASSPHRASE_LENGTH} characters`"
             />
           </div>
           <div>
diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index c94baa4d..dbc6f6fe 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -244,14 +244,14 @@ describe('useUserVault', () => {
     // while this one still saved on the old vault.
     const other = await boot()
     await other.vault.reset()
-    await other.vault.create('new horse', false)
+    await other.vault.create('new horse battery', false)
     await vault.saveProviders([work])
 
     expect(node.heads).toHaveLength(2)
     expect(vault.providers.value).toEqual([work])
     const again = await boot()
     again.vault.lock()
-    await again.vault.unlock('new horse')
+    await again.vault.unlock('new horse battery')
     expect(again.vault.providers.value).toEqual([])
     expect(node.heads).toHaveLength(2)
   })
@@ -269,7 +269,7 @@ describe('useUserVault', () => {
 
   it('opens the keys with the recovery code and sets a new passphrase from it', async () => {
     const { vault } = await boot()
-    const code = await vault.create('forgotten', true)
+    const code = await vault.create('forgotten passphrase', true)
     await vault.saveProviders([work])
     vault.lock()
 
@@ -277,24 +277,24 @@ describe('useUserVault', () => {
     await vault.unlockWithRecovery(code ?? '')
     expect(vault.providers.value).toEqual([work])
 
-    await vault.changePassphrase({ recoveryCode: code ?? '' }, 'remembered')
+    await vault.changePassphrase({ recoveryCode: code ?? '' }, 'remembered passphrase')
     vault.lock()
-    await vault.unlock('remembered')
+    await vault.unlock('remembered passphrase')
     expect(vault.state.value).toBe('unlocked')
-    expect(await nodeProviders('remembered')).toEqual([work])
+    expect(await nodeProviders('remembered passphrase')).toEqual([work])
   })
 
   it('changes the passphrase and refuses the old one', async () => {
     const { vault } = await boot()
-    await vault.create('first', false)
+    await vault.create('first passphrase', false)
 
-    await expect(vault.changePassphrase({ passphrase: 'wrong' }, 'second')).rejects.toThrow('Wrong passphrase.')
-    await vault.changePassphrase({ passphrase: 'first' }, 'second')
+    await expect(vault.changePassphrase({ passphrase: 'wrong' }, 'second passphrase')).rejects.toThrow('Wrong passphrase.')
+    await vault.changePassphrase({ passphrase: 'first passphrase' }, 'second passphrase')
 
     const restarted = await boot()
     restarted.vault.lock()
-    await expect(restarted.vault.unlock('first')).rejects.toThrow('Wrong passphrase.')
-    await restarted.vault.unlock('second')
+    await expect(restarted.vault.unlock('first passphrase')).rejects.toThrow('Wrong passphrase.')
+    await restarted.vault.unlock('second passphrase')
     expect(restarted.vault.state.value).toBe('unlocked')
   })
 
@@ -317,11 +317,11 @@ describe('useUserVault', () => {
     await vault.saveProviders([work])
 
     await vault.reset()
-    await vault.create('new horse', false)
+    await vault.create('new horse battery', false)
 
     expect(vault.state.value).toBe('unlocked')
     expect(saveVault.mock.calls.at(-1)?.[0].predecessors).toEqual([])
-    expect(await nodeProviders('new horse')).toEqual([])
+    expect(await nodeProviders('new horse battery')).toEqual([])
   })
 
   it('creates a keypair with the vault and publishes it', async () => {
@@ -394,6 +394,47 @@ describe('useUserVault', () => {
     expect(publishUserKey).not.toHaveBeenCalled()
   })
 
+  it('finishes the directory check before create and unlock resolve', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', true)
+    expect(vault.ownKey.value).toBe('matches')
+    expect(publishUserKey).toHaveBeenCalledTimes(1)
+
+    vault.lock()
+    directory.length = 0
+    await vault.unlock('correct horse')
+
+    expect(vault.ownKey.value).toBe('matches')
+    expect(publishUserKey).toHaveBeenCalledTimes(2)
+  })
+
+  it('checks the directory on request and publishes a missing key once', async () => {
+    const { vault } = await boot()
+    expect(await vault.checkKey()).toBe('unknown')
+    await vault.create('correct horse', false)
+    directory.length = 0
+    listUserKeys.mockClear()
+
+    const answers = await Promise.all([vault.checkKey(), vault.checkKey()])
+
+    expect(answers).toEqual(['matches', 'matches'])
+    expect(listUserKeys).toHaveBeenCalledTimes(1)
+    expect(publishUserKey).toHaveBeenCalledTimes(2)
+    expect(directory).toHaveLength(1)
+  })
+
+  it('refuses a holder passphrase shorter than twelve characters', async () => {
+    const { vault } = await boot()
+    await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
+    expect(saveVault).not.toHaveBeenCalled()
+
+    await vault.create('twelve chars', false)
+    await expect(vault.changePassphrase({ passphrase: 'twelve chars' }, 'too short')).rejects.toThrow(
+      'at least 12 characters',
+    )
+    expect(saveVault).toHaveBeenCalledTimes(1)
+  })
+
   it('opens the cached vault when no holder answers', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 59d39293..3ab6a50f 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -19,6 +19,7 @@ import {
 import { validateBrowserProvider, type BrowserProvider } from '@/lib/assistant/browserProviders'
 import { assistantChatScopeKey } from '@/lib/assistant/chatHistory'
 import {
+  MIN_KEY_HOLDER_PASSPHRASE_LENGTH,
   VaultUnlockError,
   activeKeypair,
   changePassphrase as rewrapMaster,
@@ -26,6 +27,7 @@ import {
   openData,
   openKeypair,
   parseVaultPayload,
+  passphraseLongEnough,
   rotateKeypair,
   sealData,
   unlockVault,
@@ -81,6 +83,7 @@ let scopeKey = ''
 let generation = 0
 let requested = false
 let inFlight: Promise<void> | null = null
+let keyCheck: Promise<void> | null = null
 
 function client() {
   return { baseUrl: apiBaseUrl.value, token: authToken.value }
@@ -168,6 +171,7 @@ async function openProviders(current: VaultPayload, key: CryptoKey): Promise<Bro
 function clearLocal() {
   generation += 1
   inFlight = null
+  keyCheck = null
   payload = null
   heads = []
   predecessors = []
@@ -319,6 +323,15 @@ async function checkOwnKey(run: number) {
   }
 }
 
+/** One directory check at a time, so two callers never publish the same key twice. */
+function checkOnce(run: number): Promise<void> {
+  const check = keyCheck ?? checkOwnKey(run).finally(() => {
+    if (keyCheck === check) keyCheck = null
+  })
+  keyCheck = check
+  return check
+}
+
 /** Adds a keypair when the vault has none, saves it with any merge, then checks the directory. */
 async function finishUnlock(run: number, saveDue: boolean) {
   if (payload && masterKey && !activeKeypair(payload.keys)) {
@@ -328,7 +341,7 @@ async function finishUnlock(run: number, saveDue: boolean) {
     saveDue = true
   }
   if (saveDue) await saveMerge(run)
-  if (run === generation) void checkOwnKey(run)
+  if (run === generation) await checkOnce(run)
 }
 
 /** Saves a merge once; when that fails the next save carries the merge. */
@@ -446,6 +459,7 @@ export function reapplyChange(
 
 function lock() {
   const scope = scopeKey
+  keyCheck = null
   masterKey = null
   providers.value = []
   ownKey.value = 'unknown'
@@ -453,6 +467,12 @@ function lock() {
   forgetKey(scope)
 }
 
+function requireHolderLength(passphrase: string) {
+  if (!passphraseLongEnough(passphrase, true)) {
+    throw new Error(`The passphrase needs at least ${MIN_KEY_HOLDER_PASSPHRASE_LENGTH} characters.`)
+  }
+}
+
 async function create(passphrase: string, withRecovery: boolean): Promise<string | null> {
   const scope = requireScope()
   if (state.value === 'unsupported') throw new Error('This node cannot keep provider keys.')
@@ -461,6 +481,7 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
     throw new Error('The provider keys on this node could not be read yet. Reload the page and try again.')
   }
   if (payload) throw new Error('Your provider keys are already set up.')
+  requireHolderLength(passphrase)
   const run = generation
   const created = await createVault(passphrase, withRecovery)
   created.payload.keys = await rotateKeypair(created.masterKey, [])
@@ -507,6 +528,7 @@ function unlockWithRecovery(recoveryCode: string): Promise<void> {
 
 /** The current passphrase or the recovery code proves the change; the keys stay unlocked. */
 async function changePassphrase(secret: VaultSecret, newPassphrase: string): Promise<void> {
+  requireHolderLength(newPassphrase)
   requirePayload()
   await saveWithRetry((current) => rewrapMaster(current, secret, newPassphrase))
 }
@@ -516,7 +538,13 @@ async function rotateKey(): Promise<void> {
   const { key } = requireUnlocked()
   const run = generation
   await saveWithRetry(async (current) => ({ ...current, keys: await rotateKeypair(key, current.keys) }))
-  if (run === generation) void checkOwnKey(run)
+  if (run === generation) await checkOnce(run)
+}
+
+/** Checks the key directory again and waits for the answer and any publication. */
+async function checkKey(): Promise<OwnKeyState> {
+  if (state.value === 'unlocked') await checkOnce(generation)
+  return ownKey.value
 }
 
 async function reset(): Promise<void> {
@@ -582,6 +610,7 @@ export function useUserVault() {
     reset,
     saveProviders,
     rotateKey,
+    checkKey,
     dismissRecreateNotice,
   }
 }

From 8a7eee0891199208a68341f8e2cf0bc098e2203d Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:05:12 +0200
Subject: [PATCH 03/86] feat: open sealed bucket key copies with shared test
 vectors

---
 src/lib/vault/__fixtures__/bucket-copy.json |  24 ++++
 src/lib/vault/bucketCopy.test.ts            |  97 ++++++++++++++
 src/lib/vault/bucketCopy.ts                 | 133 ++++++++++++++++++++
 3 files changed, 254 insertions(+)
 create mode 100644 src/lib/vault/__fixtures__/bucket-copy.json
 create mode 100644 src/lib/vault/bucketCopy.test.ts
 create mode 100644 src/lib/vault/bucketCopy.ts

diff --git a/src/lib/vault/__fixtures__/bucket-copy.json b/src/lib/vault/__fixtures__/bucket-copy.json
new file mode 100644
index 00000000..a1b18bd5
--- /dev/null
+++ b/src/lib/vault/__fixtures__/bucket-copy.json
@@ -0,0 +1,24 @@
+{
+  "description": "Shared vector for a bucket private key sealed to a user key. Portal src/lib/vault/bucketCopy.ts and Aruna core copy_info must agree on every field.",
+  "suite": "DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-256-GCM, base mode",
+  "info_layout": "purpose (UTF-8) | 0x00 | realm id (32) | node id (32) | bucket id ULID (16) | generation u64 big-endian (8) | user storage key: realm id (32) then user ULID (16) | key record ULID (16)",
+  "purpose": "aruna bucket key copy v1",
+  "realm_id": "EBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8",
+  "node_id": "8139770ea87d175f56a35466c34c7ecccb8d8a91b4ee37a25df60f5b8fc9b394",
+  "bucket_id": "01JB2S7YQ4M8N3V6K9R1T5W0XZ",
+  "generation": 258,
+  "user_id": "01J9ZK4D6W3P8E2H5Q7R9S1T0V@EBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8",
+  "key_record": "01JB2S8A0C3E5G7J9M1P3R5T7V",
+  "key_id": "01J0000000000000000000KEY1",
+  "info": "6172756e61206275636b6574206b657920636f707920763100101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f8139770ea87d175f56a35466c34c7ecccb8d8a91b4ee37a25df60f5b8fc9b3940192c593fae4a22a3d9a69c0745e03bf0000000000000102101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f01927f3234dc1d90e144b73e1390e81b0192c594280c1b8b03c9340d8782e8fb",
+  "aad": "",
+  "recipient_private": "3ec17a33432faf84bad4286c70904c097240368770f9784400d60bb28c2bc9b1",
+  "recipient_public": "41b588dc8fe632bcd1f31b336c57266175d2e12664bf8c9d271dd163ea013c2d",
+  "ephemeral_ikm": "875b208b906da78d7a10ca41ff17f2538797fbac562c29a95b0f85ee1b9b3122",
+  "ephemeral_private": "65202c769608eaa942b376fc2047e4d6825332c90a35b6eacc00711daff6493f",
+  "enc": "aee9c0672c2023f98d84568431ede938686511600b90996e64a193d7e10efb75",
+  "bucket_private": "ba1dc83021b688eb3f2a80cb102f1377bd411f19189c31c8f2447131c55345f5",
+  "bucket_public": "ec3995a8c576b0ae8c7aabfdd0701cd00ecdcbd38d833053dc3c5ad752c72153",
+  "bucket_fingerprint": "0e98b4503e1dfd284db1c3c6d34335c3e721f329b6a6b8f30af436be01cdd330",
+  "ciphertext": "4f5ccad33e0fe68941f58ea0af38016bb08aa59aacc2da2762374cc303c4ec70e4823b7b3f1b43e446a0ca8fdc4e4f8c"
+}
diff --git a/src/lib/vault/bucketCopy.test.ts b/src/lib/vault/bucketCopy.test.ts
new file mode 100644
index 00000000..8480af44
--- /dev/null
+++ b/src/lib/vault/bucketCopy.test.ts
@@ -0,0 +1,97 @@
+import { describe, expect, it } from 'vitest'
+import vector from './__fixtures__/bucket-copy.json'
+import vault from './__fixtures__/vault.json'
+import {
+  BucketKeyMismatchError,
+  COPY_PURPOSE,
+  CopyContextError,
+  copyInfo,
+  openBucketCopy,
+  type CopyContext,
+} from './bucketCopy'
+import { openKeypair, parseVaultPayload, unlockVault } from './crypto'
+import { SealOpenError, importPrivateKey, sealTo } from './hpke'
+
+function hex(text: string): Uint8Array<ArrayBuffer> {
+  return Uint8Array.from(text.match(/../g) ?? [], (pair) => parseInt(pair, 16))
+}
+
+function toHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
+}
+
+const context: CopyContext = {
+  realmId: vector.realm_id,
+  nodeId: vector.node_id,
+  bucketId: vector.bucket_id,
+  generation: vector.generation,
+  userId: vector.user_id,
+  keyRecord: vector.key_record,
+}
+const sealed = { enc: hex(vector.enc), ciphertext: hex(vector.ciphertext) }
+const bucketPublic = hex(vector.bucket_public)
+
+describe('bucket key copies', () => {
+  it('encodes the copy context exactly as the shared vector', () => {
+    expect(vector.purpose).toBe(COPY_PURPOSE)
+    expect(toHex(copyInfo(context))).toBe(vector.info)
+  })
+
+  it('reproduces the vector seal with the fixed ephemeral key', async () => {
+    const ephemeral = await importPrivateKey(hex(vector.ephemeral_private))
+
+    const again = await sealTo(hex(vector.recipient_public), copyInfo(context), new Uint8Array(0), hex(vector.bucket_private), ephemeral)
+
+    expect(toHex(again.enc)).toBe(vector.enc)
+    expect(toHex(again.ciphertext)).toBe(vector.ciphertext)
+  })
+
+  it('opens the copy with the vault keypair the copy names', async () => {
+    const payload = parseVaultPayload(vault.vault.payload)
+    const master = await unlockVault(payload, vault.vault.passphrase)
+    const entry = payload.keys.find((key) => key.id === vector.key_id)
+    const recipient = await openKeypair(master, entry!)
+
+    const key = await openBucketCopy(recipient, sealed, context, bucketPublic)
+
+    expect(toHex(key)).toBe(vector.bucket_private)
+  })
+
+  it('refuses a copy opened under any other context', async () => {
+    const recipient = await importPrivateKey(hex(vector.recipient_private))
+    const otherRealm = 'AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE'
+    const changed: CopyContext[] = [
+      { ...context, realmId: otherRealm },
+      { ...context, nodeId: vector.node_id.replace(/^81/, '82') },
+      { ...context, bucketId: '01JB2S7YQ4M8N3V6K9R1T5W0Y0' },
+      { ...context, generation: vector.generation + 1 },
+      { ...context, userId: vector.user_id.replace(/^01J9/, '01JA') },
+      { ...context, userId: `${vector.user_id.split('@')[0]}@${otherRealm}` },
+      { ...context, keyRecord: '01JB2S8A0C3E5G7J9M1P3R5T7W' },
+    ]
+
+    for (const other of changed) {
+      await expect(openBucketCopy(recipient, sealed, other, bucketPublic)).rejects.toThrow(SealOpenError)
+    }
+    const tampered = { ...sealed, ciphertext: sealed.ciphertext.slice() }
+    tampered.ciphertext[0] ^= 1
+    await expect(openBucketCopy(recipient, tampered, context, bucketPublic)).rejects.toThrow(SealOpenError)
+  })
+
+  it('refuses a copy that holds another bucket key', async () => {
+    const recipient = await importPrivateKey(hex(vector.recipient_private))
+    const otherPublic = bucketPublic.slice()
+    otherPublic[0] ^= 1
+
+    await expect(openBucketCopy(recipient, sealed, context, otherPublic)).rejects.toThrow(BucketKeyMismatchError)
+  })
+
+  it('refuses ids that are not in the node form', () => {
+    expect(() => copyInfo({ ...context, realmId: 'not base64url!' })).toThrow(CopyContextError)
+    expect(() => copyInfo({ ...context, nodeId: vector.node_id.toUpperCase() })).toThrow(CopyContextError)
+    expect(() => copyInfo({ ...context, bucketId: '01JB2S7YQ4M8N3V6K9R1T5W0XU' })).toThrow(CopyContextError)
+    expect(() => copyInfo({ ...context, bucketId: '81JB2S7YQ4M8N3V6K9R1T5W0XZ' })).toThrow(CopyContextError)
+    expect(() => copyInfo({ ...context, generation: -1 })).toThrow(CopyContextError)
+    expect(() => copyInfo({ ...context, userId: vector.user_id.split('@')[0] })).toThrow(CopyContextError)
+  })
+})
diff --git a/src/lib/vault/bucketCopy.ts b/src/lib/vault/bucketCopy.ts
new file mode 100644
index 00000000..2af1cf9c
--- /dev/null
+++ b/src/lib/vault/bucketCopy.ts
@@ -0,0 +1,133 @@
+// A bucket private key sealed with HPKE to one user key. The info binds the copy
+// to its realm, node, bucket, key generation, user and user key record, byte for
+// byte as Aruna's `copy_info`; the associated data is empty.
+import { fromBase64Url, importPrivateKey, openSealed, type SealedSecret, type X25519Pair } from './hpke'
+
+export const COPY_PURPOSE = 'aruna bucket key copy v1'
+const CROCKFORD = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'
+const ID_BYTES = 32
+const ULID_BYTES = 16
+const KEY_BYTES = 32
+
+export interface CopyContext {
+  /** Unpadded base64url of the 32-byte realm id. */
+  realmId: string
+  /** Lowercase hex of the 32-byte node id. */
+  nodeId: string
+  bucketId: string
+  generation: number
+  /** `<ULID>@<realm id>`, as the node prints a user id. */
+  userId: string
+  /** The key directory record the copy is sealed to. */
+  keyRecord: string
+}
+
+/** An id in the context is not in the form the node uses. */
+export class CopyContextError extends Error {
+  constructor(part: string) {
+    super(`The ${part} of the bucket key copy is not readable.`)
+    this.name = 'CopyContextError'
+  }
+}
+
+/** The copy opened, but the key in it is not this bucket's key. */
+export class BucketKeyMismatchError extends Error {
+  constructor() {
+    super('The opened key does not belong to this bucket.')
+    this.name = 'BucketKeyMismatchError'
+  }
+}
+
+function ulidBytes(text: string, part: string): Uint8Array {
+  if (text.length !== 26) throw new CopyContextError(part)
+  let value = 0n
+  for (const char of text.toUpperCase()) {
+    const digit = CROCKFORD.indexOf(char)
+    if (digit < 0) throw new CopyContextError(part)
+    value = (value << 5n) | BigInt(digit)
+  }
+  if (value >> 128n) throw new CopyContextError(part)
+  const bytes = new Uint8Array(ULID_BYTES)
+  for (let at = ULID_BYTES - 1; at >= 0; at -= 1) {
+    bytes[at] = Number(value & 255n)
+    value >>= 8n
+  }
+  return bytes
+}
+
+function realmBytes(text: string): Uint8Array {
+  let bytes: Uint8Array
+  try {
+    bytes = fromBase64Url(text)
+  } catch {
+    throw new CopyContextError('realm id')
+  }
+  if (bytes.length !== ID_BYTES || /[^A-Za-z0-9_-]/.test(text)) throw new CopyContextError('realm id')
+  return bytes
+}
+
+function nodeBytes(text: string): Uint8Array {
+  if (!/^[0-9a-f]{64}$/.test(text)) throw new CopyContextError('node id')
+  return Uint8Array.from(text.match(/../g) ?? [], (pair) => parseInt(pair, 16))
+}
+
+function generationBytes(generation: number): Uint8Array {
+  if (!Number.isSafeInteger(generation) || generation < 0) throw new CopyContextError('key generation')
+  const bytes = new Uint8Array(8)
+  new DataView(bytes.buffer).setBigUint64(0, BigInt(generation))
+  return bytes
+}
+
+/** The node's user storage key: realm id, then the user ULID. */
+function userBytes(userId: string): Uint8Array[] {
+  const [user, realm, extra] = userId.split('@')
+  if (!user || !realm || extra !== undefined) throw new CopyContextError('user id')
+  return [realmBytes(realm), ulidBytes(user, 'user id')]
+}
+
+/** The HPKE info of a copy: purpose label, a zero byte, then every id at its fixed length. */
+export function copyInfo(context: CopyContext): Uint8Array<ArrayBuffer> {
+  const parts = [
+    new TextEncoder().encode(COPY_PURPOSE),
+    Uint8Array.of(0),
+    realmBytes(context.realmId),
+    nodeBytes(context.nodeId),
+    ulidBytes(context.bucketId, 'bucket id'),
+    generationBytes(context.generation),
+    ...userBytes(context.userId),
+    ulidBytes(context.keyRecord, 'key record'),
+  ]
+  const info = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0))
+  let at = 0
+  for (const part of parts) {
+    info.set(part, at)
+    at += part.length
+  }
+  return info
+}
+
+function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+  return a.length === b.length && a.every((byte, index) => byte === b[index])
+}
+
+/**
+ * Opens a copy and checks that the key in it belongs to `bucketPublic`. The
+ * caller owns the returned raw key and must clear it.
+ */
+export async function openBucketCopy(
+  recipient: X25519Pair,
+  sealed: SealedSecret,
+  context: CopyContext,
+  bucketPublic: Uint8Array,
+): Promise<Uint8Array<ArrayBuffer>> {
+  const plain = await openSealed(recipient, sealed, copyInfo(context), new Uint8Array(0))
+  try {
+    if (plain.length !== KEY_BYTES) throw new BucketKeyMismatchError()
+    const { publicKey } = await importPrivateKey(plain)
+    if (!sameBytes(publicKey, bucketPublic)) throw new BucketKeyMismatchError()
+    return plain
+  } catch (cause) {
+    plain.fill(0)
+    throw cause
+  }
+}

From f5557213843063cf2a628f2f39d9e9c044b4c98c Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:07:29 +0200
Subject: [PATCH 04/86] feat: unlock a bucket with the key from a sealed copy

---
 src/composables/useUserVault.test.ts |  14 +++
 src/composables/useUserVault.ts      |   9 ++
 src/lib/vault/bucketUnlock.test.ts   | 155 +++++++++++++++++++++++++++
 src/lib/vault/bucketUnlock.ts        | 121 +++++++++++++++++++++
 src/lib/vault/crypto.ts              |  11 +-
 src/lib/vault/hpke.ts                |  12 ++-
 6 files changed, 315 insertions(+), 7 deletions(-)
 create mode 100644 src/lib/vault/bucketUnlock.test.ts
 create mode 100644 src/lib/vault/bucketUnlock.ts

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index dbc6f6fe..77f663e0 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -423,6 +423,20 @@ describe('useUserVault', () => {
     expect(directory).toHaveLength(1)
   })
 
+  it('opens a retired keypair by id for an older bucket copy', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    const first = Crypto.parseVaultPayload(node.heads[0].payload).keys[0]
+    await vault.rotateKey()
+
+    const pair = await vault.openUserKey(first.id)
+
+    expect(pair && btoa(String.fromCharCode(...pair.publicKey))).toBe(first.public)
+    expect(await vault.openUserKey('not-in-this-vault')).toBeNull()
+    vault.lock()
+    await expect(vault.openUserKey(first.id)).rejects.toThrow('Unlock your provider keys first.')
+  })
+
   it('refuses a holder passphrase shorter than twelve characters', async () => {
     const { vault } = await boot()
     await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 3ab6a50f..03a2da6e 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -35,6 +35,7 @@ import {
   type VaultPayload,
   type VaultSecret,
 } from '@/lib/vault/crypto'
+import type { X25519Pair } from '@/lib/vault/hpke'
 import { browserKeyStore } from '@/lib/vault/keyStore'
 import { apiBaseUrl, authToken, realmInfo, sessionEpoch, userInfo } from './aruna/state'
 
@@ -547,6 +548,13 @@ async function checkKey(): Promise<OwnKeyState> {
   return ownKey.value
 }
 
+/** Opens a keypair of the unlocked vault by id, retired ones included; null when it has none. */
+async function openUserKey(keyId: string): Promise<X25519Pair | null> {
+  const { current, key } = requireUnlocked()
+  const entry = current.keys.find((candidate) => candidate.id === keyId)
+  return entry ? openKeypair(key, entry) : null
+}
+
 async function reset(): Promise<void> {
   const scope = scopeKey
   await deleteVault(client())
@@ -611,6 +619,7 @@ export function useUserVault() {
     saveProviders,
     rotateKey,
     checkKey,
+    openUserKey,
     dismissRecreateNotice,
   }
 }
diff --git a/src/lib/vault/bucketUnlock.test.ts b/src/lib/vault/bucketUnlock.test.ts
new file mode 100644
index 00000000..f64cf1c9
--- /dev/null
+++ b/src/lib/vault/bucketUnlock.test.ts
@@ -0,0 +1,155 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ApiError } from '@/lib/api'
+import vector from './__fixtures__/bucket-copy.json'
+import { importPrivateKey } from './hpke'
+import { NoUsableCopyError, UnlockStaleError, unlockWithVault, type UnlockTarget } from './bucketUnlock'
+
+function hex(text: string): Uint8Array<ArrayBuffer> {
+  return Uint8Array.from(text.match(/../g) ?? [], (pair) => parseInt(pair, 16))
+}
+
+function base64(bytes: Uint8Array): string {
+  return btoa(String.fromCharCode(...bytes))
+}
+
+const COPY = {
+  bucket_id: vector.bucket_id,
+  generation: vector.generation,
+  key_record: vector.key_record,
+  key_id: vector.key_id,
+  enc: base64(hex(vector.enc)),
+  ciphertext: base64(hex(vector.ciphertext)),
+  created_at_ms: 10,
+}
+
+const TARGET: UnlockTarget = {
+  bucket: 'reef',
+  client: { baseUrl: 'https://node-b.test/api/v1', token: 'bearer-1' },
+  context: {
+    realmId: vector.realm_id,
+    nodeId: vector.node_id,
+    bucketId: vector.bucket_id,
+    generation: vector.generation,
+    userId: vector.user_id,
+  },
+  publicKey: base64(hex(vector.bucket_public)),
+  durationMs: 3_600_000,
+}
+
+interface Sent {
+  url: URL
+  method: string
+  body: Uint8Array | undefined
+  copy: string
+}
+
+function node(copies: unknown[], unlock: () => Response | Promise<Response>) {
+  const sent: Sent[] = []
+  vi.stubGlobal('window', { location: { origin: 'https://portal.test' } })
+  vi.stubGlobal('fetch', vi.fn(async (input: URL, init: RequestInit) => {
+    const url = new URL(String(input))
+    const body = init.body instanceof Uint8Array ? init.body : undefined
+    sent.push({ url, method: init.method ?? 'GET', body, copy: body ? Array.from(body, (b) => b.toString(16).padStart(2, '0')).join('') : '' })
+    if (url.pathname.endsWith('/copies/me')) return new Response(JSON.stringify({ copies }))
+    return unlock()
+  }))
+  return sent
+}
+
+function vault(keyIds = [vector.key_id]) {
+  const order: string[] = []
+  return {
+    order,
+    checkKey: vi.fn(async () => {
+      order.push('check')
+      return 'matches'
+    }),
+    openUserKey: vi.fn(async (keyId: string) => {
+      order.push(`open ${keyId}`)
+      return keyIds.includes(keyId) ? importPrivateKey(hex(vector.recipient_private)) : null
+    }),
+  }
+}
+
+const UNLOCKED = () => new Response(JSON.stringify({ state: 'unlocked', session_id: 'S1' }))
+const always = () => true
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('bucket unlock from the browser', () => {
+  it('sends only the opened bucket key to the bucket node and clears it', async () => {
+    const sent = node([COPY], UNLOCKED)
+    const keys = vault()
+
+    const outcome = await unlockWithVault(TARGET, keys, always)
+
+    expect(outcome).toEqual({ kind: 'unlocked', status: { state: 'unlocked', session_id: 'S1' }, ownKey: 'matches' })
+    expect(keys.order[0]).toBe('check')
+    const unlock = sent[1]
+    expect(unlock.url.origin).toBe('https://node-b.test')
+    expect(unlock.url.pathname).toBe('/api/v1/data/buckets/reef/storage/encryption/unlock')
+    expect(Object.fromEntries(unlock.url.searchParams)).toEqual({
+      bucket_id: vector.bucket_id,
+      generation: String(vector.generation),
+      duration_ms: '3600000',
+    })
+    expect(unlock.copy).toBe(vector.bucket_private)
+    expect(unlock.body?.every((byte) => byte === 0)).toBe(true)
+  })
+
+  it('uses the copy whose key this vault holds, an older key included', async () => {
+    const foreign = { ...COPY, key_id: 'KEY-OTHER-VAULT', created_at_ms: 20 }
+    const otherBucket = { ...COPY, bucket_id: '01JB2S7YQ4M8N3V6K9R1T5W0Y0', created_at_ms: 30 }
+    const sent = node([COPY, foreign, otherBucket], UNLOCKED)
+    const keys = vault()
+
+    expect((await unlockWithVault(TARGET, keys, always)).kind).toBe('unlocked')
+    expect(keys.order).toEqual(['check', 'open KEY-OTHER-VAULT', `open ${vector.key_id}`])
+    expect(sent[0].url.searchParams.get('generation')).toBe(String(vector.generation))
+  })
+
+  it('sends nothing when the bucket changes before the key leaves the browser', async () => {
+    const sent = node([COPY], UNLOCKED)
+    let checks = 0
+
+    await expect(unlockWithVault(TARGET, vault(), () => ++checks < 4)).rejects.toThrow(UnlockStaleError)
+
+    expect(checks).toBe(4)
+    expect(sent.map((call) => call.method)).toEqual(['GET'])
+  })
+
+  it('reports an unknown outcome once and does not send the key again', async () => {
+    const sent = node([COPY], () => Promise.reject(new TypeError('network down')))
+
+    const outcome = await unlockWithVault(TARGET, vault(), always)
+
+    expect(outcome).toEqual({ kind: 'unknown', ownKey: 'matches' })
+    expect(sent.filter((call) => call.method === 'POST')).toHaveLength(1)
+    expect(sent[1].body?.every((byte) => byte === 0)).toBe(true)
+  })
+
+  it('passes on a refusal from the node and still clears the key', async () => {
+    const sent = node([COPY], () => new Response(JSON.stringify({ error: 'no', code: 'wrong_key' }), { status: 400 }))
+
+    const failure = await unlockWithVault(TARGET, vault(), always).catch((error: unknown) => error)
+
+    expect(failure).toBeInstanceOf(ApiError)
+    expect((failure as ApiError).code).toBe('wrong_key')
+    expect(sent[1].body?.every((byte) => byte === 0)).toBe(true)
+  })
+
+  it('explains a missing, foreign or unopenable copy without sending anything', async () => {
+    node([], UNLOCKED)
+    await expect(unlockWithVault(TARGET, vault(), always)).rejects.toThrow('no ready copy')
+
+    node([COPY], UNLOCKED)
+    await expect(unlockWithVault(TARGET, vault([]), always)).rejects.toThrow('this vault does not hold')
+
+    const sent = node([COPY], UNLOCKED)
+    const wrongBucket = { ...TARGET, publicKey: base64(hex(vector.recipient_public)) }
+    await expect(unlockWithVault(wrongBucket, vault(), always)).rejects.toThrow(NoUsableCopyError)
+    expect(sent.filter((call) => call.method === 'POST')).toHaveLength(0)
+  })
+})
diff --git a/src/lib/vault/bucketUnlock.ts b/src/lib/vault/bucketUnlock.ts
new file mode 100644
index 00000000..0f69e1c7
--- /dev/null
+++ b/src/lib/vault/bucketUnlock.ts
@@ -0,0 +1,121 @@
+// Unlocks an encrypted bucket from this browser: the caller's sealed copy is
+// opened with a vault keypair and only the bucket private key goes to the node.
+// The raw key lives in one local buffer that is cleared whatever happens.
+import {
+  ApiError,
+  getMyCopies,
+  unlockBucket,
+  type ApiClientOptions,
+  type BucketUnlockStatus,
+  type SealedCopyEntry,
+} from '@/lib/api'
+import { BucketKeyMismatchError, openBucketCopy, type CopyContext } from './bucketCopy'
+import { SealOpenError, fromBase64Url, type X25519Pair } from './hpke'
+
+/** The vault operations the flow needs; `checkKey` waits for the directory check. */
+export interface UnlockVault {
+  checkKey(): Promise<string>
+  openUserKey(keyId: string): Promise<X25519Pair | null>
+}
+
+export interface UnlockTarget {
+  bucket: string
+  /** The API base of the node that hosts the bucket. */
+  client: ApiClientOptions
+  context: Omit<CopyContext, 'keyRecord'>
+  /** Standard base64 of the bucket public key the node reported. */
+  publicKey: string
+  durationMs?: number
+}
+
+export type UnlockOutcome =
+  | { kind: 'unlocked'; status: BucketUnlockStatus; ownKey: string }
+  /** The key was sent and no answer came back; read the status before trying again. */
+  | { kind: 'unknown'; ownKey: string }
+
+/** The bucket, node, account or key generation changed, so nothing was sent. */
+export class UnlockStaleError extends Error {
+  constructor() {
+    super('The bucket changed while it was being unlocked. Nothing was sent.')
+    this.name = 'UnlockStaleError'
+  }
+}
+
+/** No copy of the caller opens with this vault. */
+export class NoUsableCopyError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'NoUsableCopyError'
+  }
+}
+
+function bytes(text: string): Uint8Array<ArrayBuffer> {
+  try {
+    return fromBase64Url(text)
+  } catch {
+    throw new NoUsableCopyError('The node returned a copy that is not readable.')
+  }
+}
+
+async function openFirst(
+  copies: SealedCopyEntry[],
+  target: UnlockTarget,
+  vault: UnlockVault,
+  current: () => boolean,
+): Promise<Uint8Array<ArrayBuffer>> {
+  const publicKey = bytes(target.publicKey)
+  let held = false
+  for (const copy of copies) {
+    const pair = await vault.openUserKey(copy.key_id)
+    if (!current()) throw new UnlockStaleError()
+    if (!pair) continue
+    held = true
+    try {
+      const sealed = { enc: bytes(copy.enc), ciphertext: bytes(copy.ciphertext) }
+      return await openBucketCopy(pair, sealed, { ...target.context, keyRecord: copy.key_record }, publicKey)
+    } catch (cause) {
+      if (!(cause instanceof SealOpenError || cause instanceof BucketKeyMismatchError)) throw cause
+    }
+  }
+  if (!copies.length) {
+    throw new NoUsableCopyError('You have no ready copy of this bucket key yet. Another key holder must unlock the bucket first.')
+  }
+  throw new NoUsableCopyError(
+    held
+      ? 'Your copy of the bucket key does not open. It may belong to another bucket or node.'
+      : 'Your copy is sealed to a key this vault does not hold.',
+  )
+}
+
+/**
+ * `current` must stay true for the account, session, realm, API base, node, group,
+ * bucket id, key generation and request that started the unlock.
+ */
+export async function unlockWithVault(
+  target: UnlockTarget,
+  vault: UnlockVault,
+  current: () => boolean,
+): Promise<UnlockOutcome> {
+  const ownKey = await vault.checkKey()
+  if (!current()) throw new UnlockStaleError()
+  const { bucketId, generation } = target.context
+  const response = await getMyCopies(target.bucket, generation, target.client)
+  if (!current()) throw new UnlockStaleError()
+  const copies = response.copies
+    .filter((copy) => copy.bucket_id === bucketId && copy.generation === generation)
+    .sort((a, b) => b.created_at_ms - a.created_at_ms)
+  const key = await openFirst(copies, target, vault, current)
+  try {
+    if (!current()) throw new UnlockStaleError()
+    const request = { bucket_id: bucketId, generation, duration_ms: target.durationMs }
+    const status = await unlockBucket(target.bucket, request, key, target.client)
+    return { kind: 'unlocked', status, ownKey }
+  } catch (cause) {
+    // A gateway error or a lost answer does not say whether the node applied the key.
+    const answered = cause instanceof ApiError && cause.status !== 502 && cause.status !== 504
+    if (answered || cause instanceof UnlockStaleError) throw cause
+    return { kind: 'unknown', ownKey }
+  } finally {
+    key.fill(0)
+  }
+}
diff --git a/src/lib/vault/crypto.ts b/src/lib/vault/crypto.ts
index 701697cb..62d38894 100644
--- a/src/lib/vault/crypto.ts
+++ b/src/lib/vault/crypto.ts
@@ -342,9 +342,14 @@ export async function openKeypair(masterKey: CryptoKey, entry: VaultKeyEntry): P
   } catch {
     throw new VaultUnlockError('This key does not open the vault.')
   }
-  const pair = await importPrivateKey(new Uint8Array(plain))
-  if (toBase64(pair.publicKey) !== entry.public) throw new VaultFormatError('The vault key is not readable.')
-  return pair
+  const raw = new Uint8Array(plain)
+  try {
+    const pair = await importPrivateKey(raw)
+    if (toBase64(pair.publicKey) !== entry.public) throw new VaultFormatError('The vault key is not readable.')
+    return pair
+  } finally {
+    raw.fill(0)
+  }
 }
 
 /** Lowercase hex SHA-256 of a raw public key, the fingerprint the key directory stores. */
diff --git a/src/lib/vault/hpke.ts b/src/lib/vault/hpke.ts
index 9fee91d0..3badebf4 100644
--- a/src/lib/vault/hpke.ts
+++ b/src/lib/vault/hpke.ts
@@ -82,10 +82,14 @@ async function labeledExpand(
 /** Imports a raw X25519 private key and computes its public key. */
 export async function importPrivateKey(raw: Uint8Array): Promise<X25519Pair> {
   const pkcs8 = concat(PKCS8_PREFIX, raw)
-  const probe = await crypto.subtle.importKey('pkcs8', pkcs8, X25519, true, ['deriveBits'])
-  const jwk = await crypto.subtle.exportKey('jwk', probe)
-  const privateKey = await crypto.subtle.importKey('jwk', jwk, X25519, false, ['deriveBits'])
-  return { privateKey, publicKey: fromBase64Url(jwk.x ?? '') }
+  try {
+    const probe = await crypto.subtle.importKey('pkcs8', pkcs8, X25519, true, ['deriveBits'])
+    const jwk = await crypto.subtle.exportKey('jwk', probe)
+    const privateKey = await crypto.subtle.importKey('jwk', jwk, X25519, false, ['deriveBits'])
+    return { privateKey, publicKey: fromBase64Url(jwk.x ?? '') }
+  } finally {
+    pkcs8.fill(0)
+  }
 }
 
 /** DeriveKeyPair of RFC 9180, which the test vectors use for the ephemeral key. */

From e75b634a04b8ff33106afc056a8d8f0d2af56e24 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:09:35 +0200
Subject: [PATCH 05/86] feat: keep bucket encryption state bound to its node
 and session

---
 src/composables/useBucketEncryption.test.ts | 174 +++++++++++++++++
 src/composables/useBucketEncryption.ts      | 196 ++++++++++++++++++++
 2 files changed, 370 insertions(+)
 create mode 100644 src/composables/useBucketEncryption.test.ts
 create mode 100644 src/composables/useBucketEncryption.ts

diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
new file mode 100644
index 00000000..89a0422a
--- /dev/null
+++ b/src/composables/useBucketEncryption.test.ts
@@ -0,0 +1,174 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { ref } from 'vue'
+import * as Api from '@/lib/api'
+import { authToken, sessionEpoch, userInfo } from './aruna/state'
+import { useBucketEncryption } from './useBucketEncryption'
+
+const getBucketEncryption = vi.fn()
+const getBucketCompression = vi.fn()
+const lockBucket = vi.fn()
+const unlockWithVault = vi.fn()
+
+vi.mock('@/lib/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof Api>()),
+  getBucketEncryption: (...args: unknown[]) => getBucketEncryption(...args),
+  getBucketCompression: (...args: unknown[]) => getBucketCompression(...args),
+  lockBucket: (...args: unknown[]) => lockBucket(...args),
+}))
+vi.mock('@/lib/vault/bucketUnlock', () => ({ unlockWithVault: (...args: unknown[]) => unlockWithVault(...args) }))
+vi.mock('./useUserVault', () => ({ useUserVault: () => ({ name: 'vault' }) }))
+vi.mock('./s3/endpoints', () => ({
+  localNodeId: () => 'node-a',
+  nodeApiBase: (id: string) => ({ 'node-a': 'https://a.test/api/v1', 'node-b': 'https://b.test/api/v1' })[id] ?? null,
+}))
+
+function status(overrides: Partial<Api.BucketEncryptionResponse> = {}): Api.BucketEncryptionResponse {
+  return {
+    bucket: 'reef',
+    mode: 'vault_locked',
+    bucket_id: 'B1',
+    storage_generation: 1,
+    key_generation: 2,
+    public_key: 'PK',
+    fingerprint: 'ff',
+    cipher: 'chacha20_poly1305',
+    block_keys: 'content_derived',
+    max_unlock_ms: null,
+    unlock: { state: 'locked', lock_reason: 'restart', locked_at_ms: 1, session_id: null, unlocked_at_ms: null, deadline_ms: null, max_deadline_ms: null },
+    holders: { ready: 2, pending: 0, missing_key: 0 },
+    recovery: { state: 'met', ready_holders: 2, ready_with_recovery: 1 },
+    transition: null,
+    caller: { holder: true, ready_copy: true, admin: false },
+    ...overrides,
+  }
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (reason: unknown) => void
+  const promise = new Promise<T>((yes, no) => {
+    resolve = yes
+    reject = no
+  })
+  return { promise, resolve, reject }
+}
+
+function setup(node: string | null = 'node-b') {
+  const bucket = ref('reef')
+  const nodeId = ref<string | null>(node)
+  const encryption = useBucketEncryption(bucket, nodeId, ref('g-1'))
+  return { encryption, bucket, nodeId }
+}
+
+beforeEach(() => {
+  getBucketEncryption.mockReset().mockResolvedValue(status())
+  getBucketCompression.mockReset().mockResolvedValue({ bucket: 'reef', mode: 'zstd', level: 3, effective_level: 4 })
+  lockBucket.mockReset()
+  unlockWithVault.mockReset()
+  authToken.value = 'bearer-1'
+  userInfo.value = { user: { user_id: 'u-1' }, realm: { realm_id: 'r-1' } } as never
+})
+
+describe('bucket encryption state', () => {
+  it('asks the node that hosts the bucket, the connected one only for its own buckets', async () => {
+    const remote = setup('node-b')
+    await vi.waitFor(() => expect(remote.encryption.state.value).toBe('ready'))
+    const local = setup(null)
+    await vi.waitFor(() => expect(local.encryption.state.value).toBe('ready'))
+
+    expect(getBucketEncryption.mock.calls[0]).toEqual(['reef', { baseUrl: 'https://b.test/api/v1', token: 'bearer-1' }])
+    expect(getBucketEncryption.mock.calls[1]).toEqual(['reef', { baseUrl: 'https://a.test/api/v1', token: 'bearer-1' }])
+    expect(remote.encryption.compression.value?.effective_level).toBe(4)
+  })
+
+  it('drops an answer for a bucket that is no longer shown', async () => {
+    const first = deferred<Api.BucketEncryptionResponse>()
+    getBucketEncryption.mockReturnValueOnce(first.promise)
+    const { encryption, bucket } = setup()
+
+    bucket.value = 'other'
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    first.resolve(status({ bucket_id: 'STALE' }))
+    await first.promise
+
+    expect(encryption.status.value?.bucket_id).toBe('B1')
+  })
+
+  it('tells a node without the report and a refusal apart from encryption off', async () => {
+    getBucketEncryption.mockRejectedValueOnce(new Api.ApiError(404, 'Not found'))
+    const missing = setup()
+    await vi.waitFor(() => expect(missing.encryption.state.value).toBe('missing'))
+    getBucketEncryption.mockRejectedValueOnce(new Api.ApiError(403, 'Forbidden'))
+    const refused = setup()
+    await vi.waitFor(() => expect(refused.encryption.state.value).toBe('refused'))
+
+    expect(missing.encryption.status.value).toBeNull()
+    expect(refused.encryption.status.value).toBeNull()
+  })
+
+  it('unlocks with the context of the shown key and reads the status before answering', async () => {
+    const { encryption } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    unlockWithVault.mockResolvedValue({ kind: 'unlocked', status: { state: 'unlocked' }, ownKey: 'matches' })
+    getBucketEncryption.mockResolvedValue(status({ unlock: { ...status().unlock!, state: 'unlocked', session_id: 'S2' } }))
+
+    const outcome = await encryption.unlock(60_000)
+
+    expect(outcome?.kind).toBe('unlocked')
+    const [target, vault, live] = unlockWithVault.mock.calls[0]
+    expect(target).toEqual({
+      bucket: 'reef',
+      client: { baseUrl: 'https://b.test/api/v1', token: 'bearer-1' },
+      context: { realmId: 'r-1', nodeId: 'node-b', bucketId: 'B1', generation: 2, userId: 'u-1' },
+      publicKey: 'PK',
+      durationMs: 60_000,
+    })
+    expect(vault).toEqual({ name: 'vault' })
+    expect(live()).toBe(true)
+    expect(encryption.status.value?.unlock?.session_id).toBe('S2')
+    expect(encryption.busy.value).toBeNull()
+  })
+
+  it('keeps an unconfirmed unlock blocked until the node reports the status again', async () => {
+    const { encryption } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    unlockWithVault.mockResolvedValue({ kind: 'unknown', ownKey: 'matches' })
+    getBucketEncryption.mockRejectedValueOnce(new TypeError('network down'))
+
+    await encryption.unlock()
+
+    expect(encryption.outcomeUnknown.value).toBe(true)
+    await expect(encryption.unlock()).rejects.toThrow('not confirmed')
+    expect(unlockWithVault).toHaveBeenCalledTimes(1)
+    await encryption.load()
+    expect(encryption.outcomeUnknown.value).toBe(false)
+  })
+
+  it('forgets an unlock that ends after the session changed', async () => {
+    const { encryption } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    const pending = deferred<unknown>()
+    unlockWithVault.mockReturnValue(pending.promise)
+
+    const answer = encryption.unlock()
+    await vi.waitFor(() => expect(unlockWithVault).toHaveBeenCalled())
+    const live = unlockWithVault.mock.calls[0][2] as () => boolean
+    sessionEpoch.value += 1
+    pending.resolve({ kind: 'unlocked', status: {}, ownKey: 'matches' })
+
+    expect(await answer).toBeNull()
+    expect(live()).toBe(false)
+  })
+
+  it('stops the unlock when the bucket key changes under it', async () => {
+    const { encryption } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    unlockWithVault.mockImplementation(async (_target, _vault, live: () => boolean) => {
+      getBucketEncryption.mockResolvedValue(status({ key_generation: 3 }))
+      await encryption.load()
+      return { kind: live() ? 'unlocked' : 'stale' }
+    })
+
+    expect((await encryption.unlock())?.kind).toBe('stale')
+  })
+})
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
new file mode 100644
index 00000000..5efbb49a
--- /dev/null
+++ b/src/composables/useBucketEncryption.ts
@@ -0,0 +1,196 @@
+// Encryption state of one bucket, asked of the node that hosts it. An answer is
+// kept only while the account, session, realm, node API base, group and bucket
+// it was asked for are still current; anything else is dropped unseen.
+import { computed, ref, watch, type Ref } from 'vue'
+import {
+  ApiError,
+  apiErrorMessage,
+  extendUnlock,
+  getBucketCompression,
+  getBucketEncryption,
+  lockBucket,
+  putBucketEncryption,
+  rotateBucketKey,
+  type ApiClientOptions,
+  type BucketCompressionResponse,
+  type BucketEncryptionResponse,
+  type PutBucketEncryptionRequest,
+} from '@/lib/api'
+import { unlockWithVault, type UnlockOutcome } from '@/lib/vault/bucketUnlock'
+import { authToken, nodeInfo, realmInfo, sessionEpoch, userInfo } from './aruna/state'
+import { localNodeId, nodeApiBase } from './s3/endpoints'
+import { useUserVault } from './useUserVault'
+
+/** `missing`: the node does not report encryption for this bucket, which is not "off". */
+export type EncryptionLoadState = 'loading' | 'ready' | 'missing' | 'refused' | 'unresolved' | 'failed'
+export type EncryptionAction = 'unlock' | 'extend' | 'lock' | 'save' | 'rotate'
+
+export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | null>, groupId: Ref<string | null>) {
+  const vault = useUserVault()
+  const status = ref<BucketEncryptionResponse | null>(null)
+  const compression = ref<BucketCompressionResponse | null>(null)
+  const state = ref<EncryptionLoadState>('loading')
+  const error = ref<string | null>(null)
+  const refreshing = ref(false)
+  const busy = ref<EncryptionAction | null>(null)
+  /** An unlock whose answer never came; only a successful status read clears it. */
+  const outcomeUnknown = ref(false)
+  let loads = 0
+
+  const scope = computed(() => {
+    const node = nodeId.value ?? localNodeId() ?? ''
+    return {
+      userId: userInfo.value?.user.user_id ?? '',
+      realmId: userInfo.value?.realm.realm_id ?? realmInfo.value?.realm_id ?? '',
+      epoch: sessionEpoch.value,
+      nodeId: node,
+      apiBase: node ? (nodeApiBase(node) ?? '') : '',
+      groupId: groupId.value ?? '',
+      bucket: bucket.value,
+    }
+  })
+  const scopeKey = computed(() => JSON.stringify(scope.value))
+
+  function client(): ApiClientOptions {
+    return { baseUrl: scope.value.apiBase, token: authToken.value }
+  }
+
+  /** A check that stays true while the scope a request started in is current. */
+  function binder(): () => boolean {
+    const key = scopeKey.value
+    return () => scopeKey.value === key
+  }
+
+  function failed(cause: unknown): EncryptionLoadState {
+    if (!(cause instanceof ApiError)) return 'failed'
+    if (cause.status === 404 || cause.status === 405) return 'missing'
+    return cause.status === 401 || cause.status === 403 ? 'refused' : 'failed'
+  }
+
+  async function load(): Promise<void> {
+    const run = ++loads
+    const bound = binder()
+    const live = () => bound() && run === loads
+    const { apiBase, nodeId: node } = scope.value
+    if (!apiBase) {
+      status.value = null
+      state.value = node || nodeInfo.value ? 'unresolved' : 'loading'
+      return
+    }
+    refreshing.value = true
+    const [encryption, compressed] = await Promise.allSettled([
+      getBucketEncryption(scope.value.bucket, client()),
+      getBucketCompression(scope.value.bucket, client()),
+    ])
+    if (!live()) return
+    refreshing.value = false
+    compression.value = compressed.status === 'fulfilled' ? compressed.value : null
+    if (encryption.status === 'fulfilled') {
+      status.value = encryption.value
+      state.value = 'ready'
+      error.value = null
+      outcomeUnknown.value = false
+      return
+    }
+    status.value = null
+    state.value = failed(encryption.reason)
+    error.value = apiErrorMessage(encryption.reason)
+  }
+
+  async function run<T>(action: EncryptionAction, work: (bound: () => boolean) => Promise<T>): Promise<T | null> {
+    if (busy.value) throw new Error('Another change to this bucket is still running.')
+    const bound = binder()
+    busy.value = action
+    try {
+      const result = await work(bound)
+      return bound() ? result : null
+    } finally {
+      // The status is read again before any outcome is shown, also after a failure.
+      if (bound()) {
+        await load()
+        busy.value = null
+      }
+    }
+  }
+
+  /** Opens the caller's copy in this browser and sends only the bucket key to the node. */
+  function unlock(durationMs?: number): Promise<UnlockOutcome | null> {
+    const seen = status.value
+    if (outcomeUnknown.value) {
+      return Promise.reject(new Error('The last unlock was not confirmed. Reload the status before trying again.'))
+    }
+    if (!seen?.bucket_id || !seen.public_key) return Promise.reject(new Error('This bucket has no key to unlock.'))
+    const { bucket_id: bucketId, key_generation: generation, public_key: publicKey } = seen
+    return run('unlock', async (bound) => {
+      const live = () => bound() && status.value?.bucket_id === bucketId && status.value.key_generation === generation
+      const { realmId, nodeId: node, userId } = scope.value
+      const outcome = await unlockWithVault(
+        {
+          bucket: scope.value.bucket,
+          client: client(),
+          context: { realmId, nodeId: node, bucketId, generation, userId },
+          publicKey,
+          durationMs,
+        },
+        vault,
+        live,
+      )
+      if (outcome.kind === 'unknown' && bound()) outcomeUnknown.value = true
+      return outcome
+    })
+  }
+
+  function extend(durationMs?: number) {
+    const session = status.value?.unlock?.session_id
+    if (!session) return Promise.reject(new Error('The bucket is not unlocked.'))
+    return run('extend', () => extendUnlock(scope.value.bucket, { session_id: session, duration_ms: durationMs }, client()))
+  }
+
+  function lock() {
+    return run('lock', () => lockBucket(scope.value.bucket, client()))
+  }
+
+  function save(request: PutBucketEncryptionRequest) {
+    return run('save', () => putBucketEncryption(scope.value.bucket, request, client()))
+  }
+
+  function rotate() {
+    const generation = status.value?.key_generation
+    if (generation === undefined) return Promise.reject(new Error('The bucket status is not known.'))
+    return run('rotate', () => rotateBucketKey(scope.value.bucket, generation, client()))
+  }
+
+  watch(
+    scopeKey,
+    () => {
+      status.value = null
+      compression.value = null
+      error.value = null
+      busy.value = null
+      refreshing.value = false
+      outcomeUnknown.value = false
+      state.value = 'loading'
+      void load()
+    },
+    { immediate: true },
+  )
+
+  return {
+    status,
+    compression,
+    state,
+    error,
+    refreshing,
+    busy,
+    outcomeUnknown,
+    nodeId: computed(() => scope.value.nodeId || null),
+    load,
+    unlock,
+    extend,
+    lock,
+    save,
+    rotate,
+    client,
+    binder,
+  }
+}

From 323760d58091dffa2adc83cd7bb1083a80b03a9a Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:11:26 +0200
Subject: [PATCH 06/86] feat: describe bucket lock, recovery and transition
 states

---
 src/lib/bucketEncryption.test.ts |  81 ++++++++++++++++
 src/lib/bucketEncryption.ts      | 155 +++++++++++++++++++++++++++++++
 src/lib/stateBadge.ts            |  13 +++
 3 files changed, 249 insertions(+)
 create mode 100644 src/lib/bucketEncryption.test.ts
 create mode 100644 src/lib/bucketEncryption.ts

diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
new file mode 100644
index 00000000..f88b1325
--- /dev/null
+++ b/src/lib/bucketEncryption.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import type { BucketEncryptionResponse, BucketUnlockStatus, EncryptionTransition } from './api'
+import {
+  compressionSummary,
+  holderSummary,
+  lockView,
+  modeLabel,
+  recoverySummary,
+  transitionView,
+} from './bucketEncryption'
+import { stateTone } from './stateBadge'
+
+const LOCKED: BucketUnlockStatus = {
+  state: 'locked',
+  lock_reason: 'manual',
+  locked_at_ms: null,
+  session_id: null,
+  unlocked_at_ms: null,
+  deadline_ms: null,
+  max_deadline_ms: null,
+}
+
+function bucket(unlock: BucketUnlockStatus | null, mode: BucketEncryptionResponse['mode'] = 'vault_locked') {
+  return { mode, unlock } as BucketEncryptionResponse
+}
+
+const TRANSITION: EncryptionTransition = {
+  kind: 'encrypt',
+  state: 'running',
+  source_generation: null,
+  target_generation: 1,
+  done: 40,
+  remaining: 10,
+  failed: 0,
+  cleanup_remaining: 50,
+  started_at_ms: 1,
+  finished_at_ms: null,
+  blocked_reason: null,
+}
+
+describe('bucket encryption wording', () => {
+  it('names the four lock states and an unreported one', () => {
+    expect(lockView(bucket(LOCKED)).label).toBe('Locked')
+    expect(lockView(bucket({ ...LOCKED, lock_reason: 'restart' })).label).toBe('Locked since restart')
+    expect(lockView(bucket({ ...LOCKED, state: 'unlocked', lock_reason: null })).label).toBe('Unlocked')
+    expect(lockView(bucket({ ...LOCKED, state: 'unlocked', deadline_ms: 5_000 })).label).toBe('Timed unlock')
+    expect(lockView(bucket(null)).label).toBe('Unknown')
+    expect(lockView(bucket(null, 'off')).label).toBe('Not encrypted')
+    expect(stateTone('Locked since restart')).toBe('attention')
+  })
+
+  it('never turns an unknown count into zero', () => {
+    expect(holderSummary(null)).toBe('Unknown')
+    expect(holderSummary({ ready: null, pending: null, missing_key: null })).toBe('Unknown')
+    expect(holderSummary({ ready: 2, pending: null, missing_key: 0 })).toBe('2 ready, 0 without a key, others unknown')
+    expect(holderSummary({ ready: 2, pending: 1, missing_key: 0 })).toBe('2 ready, 1 pending, 0 without a key')
+    expect(recoverySummary(null).label).toBe('Unknown')
+    expect(recoverySummary({ state: 'degraded', ready_holders: 1, ready_with_recovery: 0 }).label).toBe('Not met')
+    expect(modeLabel(undefined)).toBe('Unknown')
+  })
+
+  it('reports the effective Pithos level only for an encrypted bucket that names it', () => {
+    expect(compressionSummary(null, true)).toBe('Unknown')
+    expect(compressionSummary({ bucket: 'b', mode: 'off' }, true)).toBe('Off')
+    expect(compressionSummary({ bucket: 'b', mode: 'zstd', level: 3, effective_level: 4 }, true)).toBe(
+      'zstd level 3, applied as level 4 in Pithos',
+    )
+    expect(compressionSummary({ bucket: 'b', mode: 'zstd', level: 3 }, true)).toContain('not reported')
+    expect(compressionSummary({ bucket: 'b', mode: 'zstd', level: 3, effective_level: 4 }, false)).toBe('zstd level 3')
+  })
+
+  it('calls a transition complete only after cleanup finished', () => {
+    expect(transitionView(TRANSITION)).toMatchObject({ state: 'Running', complete: false })
+    expect(transitionView(TRANSITION).detail).toBe('40 done, 10 left, 50 old copies to remove.')
+    const visited = { ...TRANSITION, state: 'finished' as const, remaining: 0 }
+    expect(transitionView(visited)).toMatchObject({ state: 'Cleanup open', complete: false })
+    expect(transitionView({ ...visited, cleanup_remaining: null }).complete).toBe(false)
+    expect(transitionView({ ...visited, cleanup_remaining: 0 })).toMatchObject({ state: 'Finished', complete: true })
+    expect(transitionView({ ...TRANSITION, remaining: null }).detail).toContain('an unknown number left')
+  })
+})
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
new file mode 100644
index 00000000..67ad3e95
--- /dev/null
+++ b/src/lib/bucketEncryption.ts
@@ -0,0 +1,155 @@
+// Words for the encryption state of a bucket. A value the node did not report
+// reads as unknown, never as zero, empty, off or complete.
+import type {
+  BlockCipher,
+  BlockKeys,
+  BucketCompressionResponse,
+  BucketEncryptionResponse,
+  EncryptionMode,
+  EncryptionTransition,
+  HolderReadiness,
+  RecoveryStatus,
+} from './api'
+import { formatDuration } from './utils'
+
+export const MODE_LABEL: Record<EncryptionMode, string> = {
+  off: 'Off',
+  node_managed: 'Node-managed',
+  vault_locked: 'Vault-locked',
+}
+
+export const CIPHER_LABEL: Record<BlockCipher, string> = {
+  chacha20_poly1305: 'ChaCha20-Poly1305',
+  aes256_gcm: 'AES-256-GCM',
+}
+
+export const BLOCK_KEYS_LABEL: Record<BlockKeys, string> = {
+  content_derived: 'Derived from block content',
+  unique: 'A new key for every block',
+}
+
+const UNKNOWN = 'Unknown'
+
+function known<T extends string>(labels: Record<T, string>, value: T | null | undefined): string {
+  return (value && labels[value]) || UNKNOWN
+}
+
+export const modeLabel = (mode: EncryptionMode | null | undefined) => known(MODE_LABEL, mode)
+export const cipherLabel = (cipher: BlockCipher | null | undefined) => known(CIPHER_LABEL, cipher)
+export const blockKeysLabel = (keys: BlockKeys | null | undefined) => known(BLOCK_KEYS_LABEL, keys)
+
+export interface LockView {
+  /** Also the `stateBadge` key. */
+  label: string
+  detail: string
+}
+
+function at(ms: number): string {
+  return new Date(ms).toLocaleString()
+}
+
+/** Locked, unlocked, timed unlock or locked since restart; unknown when the node gave no lock state. */
+export function lockView(status: BucketEncryptionResponse): LockView {
+  if (status.mode === 'off') return { label: 'Not encrypted', detail: 'Stored bytes are readable without a key.' }
+  const unlock = status.unlock
+  if (!unlock) return { label: UNKNOWN, detail: 'The node did not report whether the bucket is unlocked.' }
+  if (unlock.state === 'unlocked') {
+    return unlock.deadline_ms !== null
+      ? { label: 'Timed unlock', detail: `Locks itself at ${at(unlock.deadline_ms)}.` }
+      : { label: 'Unlocked', detail: 'Until a key holder locks it or the node restarts.' }
+  }
+  if (unlock.lock_reason === 'restart') {
+    return { label: 'Locked since restart', detail: 'The node restarted. A key holder must unlock it again.' }
+  }
+  const since = unlock.locked_at_ms !== null ? ` since ${at(unlock.locked_at_ms)}` : ''
+  const why = unlock.lock_reason === 'timed' ? 'The timed unlock ended' : 'Locked'
+  return { label: 'Locked', detail: `${why}${since}.` }
+}
+
+function count(value: number | null | undefined, noun: string): string | null {
+  if (value === null || value === undefined) return null
+  return `${value} ${noun}`
+}
+
+/** "2 ready, 1 pending, 1 without a key"; unknown parts are said to be unknown. */
+export function holderSummary(holders: HolderReadiness | null): string {
+  if (!holders) return UNKNOWN
+  const parts = [
+    count(holders.ready, 'ready'),
+    count(holders.pending, 'pending'),
+    count(holders.missing_key, 'without a key'),
+  ]
+  if (parts.every((part) => part === null)) return UNKNOWN
+  const shown = parts.filter((part): part is string => part !== null)
+  return parts.includes(null) ? `${shown.join(', ')}, others unknown` : shown.join(', ')
+}
+
+export function recoverySummary(recovery: RecoveryStatus | null): LockView {
+  if (!recovery || recovery.state === 'unknown') {
+    return { label: UNKNOWN, detail: 'The key directory did not answer, so the recovery rule could not be checked.' }
+  }
+  if (recovery.state === 'met') {
+    return { label: 'Met', detail: 'Two ready key holders, or one with a recovery code.' }
+  }
+  return {
+    label: 'Not met',
+    detail: 'Recovery needs a usable recovery code or another ready key holder. Losing the last key loses the data.',
+  }
+}
+
+export function compressionSummary(
+  compression: BucketCompressionResponse | null,
+  encrypted: boolean,
+): string {
+  if (!compression) return UNKNOWN
+  if (compression.mode === 'off') return 'Off'
+  const requested = compression.level === undefined ? 'zstd' : `zstd level ${compression.level}`
+  if (!encrypted) return requested
+  return compression.effective_level === undefined
+    ? `${requested}; the level Pithos applies is not reported`
+    : `${requested}, applied as level ${compression.effective_level} in Pithos`
+}
+
+export function maxUnlockLabel(ms: number | null): string {
+  return ms === null ? 'Until lock or restart' : formatDuration(ms)
+}
+
+const KIND_LABEL: Record<EncryptionTransition['kind'], string> = {
+  encrypt: 'Encrypting stored versions',
+  decrypt: 'Decrypting stored versions',
+  reencode: 'Writing stored versions in the new format',
+  rotate: 'Granting stored versions to the new key',
+}
+
+const STATE_LABEL: Record<EncryptionTransition['state'], string> = {
+  running: 'Running',
+  awaiting_key: 'Waiting for an unlock',
+  cleanup: 'Removing old copies',
+  blocked: 'Blocked',
+  finished: 'Finished',
+}
+
+export interface TransitionView {
+  title: string
+  state: string
+  detail: string
+  /** Every version rewritten and every old copy removed. */
+  complete: boolean
+}
+
+export function transitionView(transition: EncryptionTransition): TransitionView {
+  const remaining = transition.remaining === null ? 'an unknown number' : String(transition.remaining)
+  const cleanup =
+    transition.cleanup_remaining === null
+      ? 'old copies still to count'
+      : `${transition.cleanup_remaining} old ${transition.cleanup_remaining === 1 ? 'copy' : 'copies'} to remove`
+  const failed = transition.failed ? `, ${transition.failed} failed` : ''
+  const complete =
+    transition.state === 'finished' && transition.remaining === 0 && transition.cleanup_remaining === 0
+  return {
+    title: known(KIND_LABEL, transition.kind),
+    state: complete ? 'Finished' : transition.state === 'finished' ? 'Cleanup open' : known(STATE_LABEL, transition.state),
+    detail: `${transition.done} done, ${remaining} left${failed}, ${cleanup}.`,
+    complete,
+  }
+}
diff --git a/src/lib/stateBadge.ts b/src/lib/stateBadge.ts
index 961574ac..a3cb71e4 100644
--- a/src/lib/stateBadge.ts
+++ b/src/lib/stateBadge.ts
@@ -95,6 +95,19 @@ const STATE_TONE: Record<string, StateTone> = {
   offline: 'attention',
   unreachable: 'attention',
   reachable: 'done',
+  // Bucket encryption.
+  'not encrypted': 'idle',
+  locked: 'idle',
+  unlocked: 'done',
+  'timed unlock': 'progress',
+  'locked since restart': 'attention',
+  met: 'done',
+  'not met': 'attention',
+  finished: 'done',
+  'cleanup open': 'progress',
+  'removing old copies': 'progress',
+  'waiting for an unlock': 'attention',
+  blocked: 'attention',
 }
 
 /** The tone for a state string; anything unknown reads as a neutral count. */

From 90f6525423cbcc149004ac25c6a8dfaa1d657395 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:13:02 +0200
Subject: [PATCH 07/86] feat: show bucket encryption on its own settings tab

---
 .../storage/BucketEncryptionTab.test.ts       | 140 ++++++++++++++++++
 .../storage/BucketEncryptionTab.vue           | 127 ++++++++++++++++
 src/views/BucketStorageView.test.ts           |  12 +-
 src/views/BucketStorageView.vue               |   8 +-
 4 files changed, 281 insertions(+), 6 deletions(-)
 create mode 100644 src/components/storage/BucketEncryptionTab.test.ts
 create mode 100644 src/components/storage/BucketEncryptionTab.vue

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
new file mode 100644
index 00000000..df5faef5
--- /dev/null
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -0,0 +1,140 @@
+import { defineComponent, h, ref } from 'vue'
+import * as VueRuntime from 'vue'
+import { describe, expect, it } from 'vitest'
+import type { BucketCompressionResponse, BucketEncryptionResponse } from '@/lib/api'
+import * as Wording from '@/lib/bucketEncryption'
+import * as StateBadge from '@/lib/stateBadge'
+import type { EncryptionLoadState } from '@/composables/useBucketEncryption'
+import { compileClientComponent, content, mountApp, moduleDefault } from '@/test/clientRender'
+
+const status = ref<BucketEncryptionResponse | null>(null)
+const compression = ref<BucketCompressionResponse | null>(null)
+const state = ref<EncryptionLoadState>('loading')
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+const NoticeStub = defineComponent({
+  props: { title: String, lines: Array },
+  setup: (props, { slots }) => () =>
+    h('aside', [props.title, slots.default?.(), ...((props.lines as string[] | undefined) ?? []).map((line) => h('p', line))]),
+})
+const DetailStub = defineComponent({
+  props: { items: Array },
+  setup: (props) => () =>
+    h('dl', (props.items as { label: string; value: string }[]).map((item) => h('p', `${item.label}: ${item.value}`))),
+})
+
+const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
+  '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
+  '@/components/ui/DetailList.vue': moduleDefault(DetailStub),
+  '@/components/ui/NodeLabel.vue': moduleDefault(Slotted('span')),
+  '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
+  '@/components/ui/RefreshButton.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/SectionSkeleton.vue': moduleDefault(defineComponent(() => () => h('section', 'loading placeholder'))),
+  '@/composables/useBucketEncryption': {
+    useBucketEncryption: () => ({
+      status,
+      compression,
+      state,
+      error: ref('The node did not answer.'),
+      refreshing: ref(false),
+      nodeId: ref('node-b'),
+      load: () => undefined,
+    }),
+  },
+  '@/lib/bucketEncryption': Wording,
+  '@/lib/stateBadge': StateBadge,
+})
+
+function encrypted(overrides: Partial<BucketEncryptionResponse> = {}): BucketEncryptionResponse {
+  return {
+    bucket: 'reef',
+    mode: 'vault_locked',
+    bucket_id: 'B1',
+    storage_generation: 1,
+    key_generation: 2,
+    public_key: 'PK',
+    fingerprint: 'abcdef0123',
+    cipher: 'chacha20_poly1305',
+    block_keys: 'content_derived',
+    max_unlock_ms: null,
+    unlock: {
+      state: 'locked',
+      lock_reason: 'restart',
+      locked_at_ms: 1,
+      session_id: null,
+      unlocked_at_ms: null,
+      deadline_ms: null,
+      max_deadline_ms: null,
+    },
+    holders: { ready: 1, pending: null, missing_key: 0 },
+    recovery: { state: 'degraded', ready_holders: 1, ready_with_recovery: 0 },
+    transition: null,
+    caller: { holder: true, ready_copy: true, admin: false },
+    ...overrides,
+  }
+}
+
+async function render(next: EncryptionLoadState, value: BucketEncryptionResponse | null = null) {
+  state.value = next
+  status.value = value
+  compression.value = { bucket: 'reef', mode: 'zstd', level: 3, effective_level: 4 }
+  const { root } = await mountApp(tab, { props: { bucket: 'reef', nodeId: 'node-b', groupId: 'g-1' } })
+  return content(root)
+}
+
+describe('bucket encryption tab', () => {
+  it('never shows an unreported state as encryption off', async () => {
+    expect(await render('loading')).toContain('loading placeholder')
+    const missing = await render('missing')
+    expect(missing).toContain('does not report its encryption')
+    expect(missing).not.toContain('Off')
+    expect(await render('failed')).toContain('unknown until the node answers')
+  })
+
+  it('shows the lock state, key, format and recovery of a vault-locked bucket', async () => {
+    const text = await render('ready', encrypted())
+
+    expect(text).toContain('Locked since restart')
+    expect(text).toContain('Key fingerprint: abcdef0123')
+    expect(text).toContain('Cipher: ChaCha20-Poly1305')
+    expect(text).toContain('Compression: zstd level 3, applied as level 4 in Pithos')
+    expect(text).toContain('Key holders: 1 ready, 0 without a key, others unknown')
+    expect(text).toContain('Not met')
+    expect(text).toContain('you may unlock, extend and lock')
+    expect(text).toContain('A node restart locks vault-locked buckets.')
+  })
+
+  it('keeps a rewrite open until its old copies are removed', async () => {
+    const transition = {
+      kind: 'encrypt' as const,
+      state: 'finished' as const,
+      source_generation: null,
+      target_generation: 2,
+      done: 12,
+      remaining: 0,
+      failed: 0,
+      cleanup_remaining: 3,
+      started_at_ms: 1,
+      finished_at_ms: 2,
+      blocked_reason: null,
+    }
+    const text = await render('ready', encrypted({ transition }))
+
+    expect(text).toContain('Encrypting stored versions')
+    expect(text).toContain('Cleanup open')
+    expect(text).toContain('3 old copies to remove')
+  })
+
+  it('shows a plain bucket without key details', async () => {
+    const text = await render('ready', encrypted({ mode: 'off', unlock: null, public_key: null, fingerprint: null }))
+
+    expect(text).toContain('Mode: Off')
+    expect(text).toContain('Not encrypted')
+    expect(text).not.toContain('Key fingerprint')
+    expect(text).toContain('Compression: zstd level 3')
+    expect(text).not.toContain('applied as level')
+  })
+})
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
new file mode 100644
index 00000000..03cb4d77
--- /dev/null
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -0,0 +1,127 @@
+<script setup lang="ts">
+// The encryption of one bucket as the node that hosts it reports it: mode, lock
+// state, key fingerprint, format, holders, recovery and any rewrite that runs.
+import { computed, toRef } from 'vue'
+import Badge from '@/components/ui/Badge.vue'
+import DetailList, { type Detail } from '@/components/ui/DetailList.vue'
+import NodeLabel from '@/components/ui/NodeLabel.vue'
+import Notice from '@/components/ui/Notice.vue'
+import RefreshButton from '@/components/ui/RefreshButton.vue'
+import SectionSkeleton from '@/components/ui/SectionSkeleton.vue'
+import { useBucketEncryption } from '@/composables/useBucketEncryption'
+import {
+  blockKeysLabel,
+  cipherLabel,
+  compressionSummary,
+  holderSummary,
+  lockView,
+  maxUnlockLabel,
+  modeLabel,
+  recoverySummary,
+  transitionView,
+} from '@/lib/bucketEncryption'
+import { stateVariant } from '@/lib/stateBadge'
+import { KeyRound } from '@lucide/vue'
+
+const props = defineProps<{ bucket: string; nodeId: string | null; groupId: string | null }>()
+
+const encryption = useBucketEncryption(toRef(props, 'bucket'), toRef(props, 'nodeId'), toRef(props, 'groupId'))
+const { status, compression, state, error, refreshing } = encryption
+
+const encrypted = computed(() => Boolean(status.value && status.value.mode !== 'off'))
+const lock = computed(() => (status.value ? lockView(status.value) : null))
+const recovery = computed(() => recoverySummary(status.value?.recovery ?? null))
+const transition = computed(() => (status.value?.transition ? transitionView(status.value.transition) : null))
+
+const details = computed<Detail[]>(() => {
+  const current = status.value
+  if (!current) return []
+  const items: Detail[] = [{ label: 'Mode', value: modeLabel(current.mode) }]
+  if (encrypted.value) {
+    items.push(
+      { label: 'Key fingerprint', value: current.fingerprint ?? 'Unknown', mono: true },
+      { label: 'Key generation', value: String(current.key_generation) },
+      { label: 'Cipher', value: cipherLabel(current.cipher) },
+      { label: 'Block keys', value: blockKeysLabel(current.block_keys) },
+      { label: 'Longest unlock', value: maxUnlockLabel(current.max_unlock_ms) },
+      { label: 'Key holders', value: holderSummary(current.holders) },
+    )
+  }
+  items.push({ label: 'Compression', value: compressionSummary(compression.value, encrypted.value) })
+  return items
+})
+
+const permitted = computed(() => {
+  const caller = status.value?.caller
+  if (!caller) return []
+  const lines: string[] = []
+  if (caller.holder && caller.ready_copy) lines.push('You hold a ready copy of the bucket key: you may unlock, extend and lock.')
+  else if (caller.holder) lines.push('You are a key holder, but your copy is not ready. It is made at the next unlock.')
+  if (caller.admin) lines.push('As a group admin you may lock, change the mode, manage key holders and rotate the key.')
+  if (!lines.length) lines.push('You may read this state. Unlocking and settings need a key holder or a group admin.')
+  return lines
+})
+
+const WARNINGS = [
+  'An unlock lets every reader with access on this node read the bucket until it locks.',
+  'A node restart locks vault-locked buckets.',
+  'Recovery needs a usable recovery code or another ready key holder.',
+]
+</script>
+
+<template>
+  <div class="space-y-5">
+    <SectionSkeleton v-if="state === 'loading'" label="Loading the encryption state" />
+    <Notice v-else-if="state === 'missing'" tone="info" title="Encryption is not reported here">
+      The node that hosts this bucket does not report its encryption. It may run an older Aruna version.
+    </Notice>
+    <Notice v-else-if="state === 'refused'" tone="warning">
+      You may not read the encryption settings of this bucket.
+    </Notice>
+    <Notice v-else-if="state === 'unresolved'" tone="warning">
+      The node that hosts this bucket publishes no API address, so its encryption cannot be read from here.
+    </Notice>
+    <Notice v-else-if="state === 'failed'" tone="error" :title="error ?? undefined">
+      The encryption state is unknown until the node answers.
+    </Notice>
+
+    <template v-else-if="status">
+      <section class="surface">
+        <header class="flex flex-wrap items-center gap-2 border-b border-border px-5 py-4">
+          <KeyRound class="size-4 text-primary" />
+          <h2 class="font-display text-sm font-semibold text-aruna-navy">Encryption</h2>
+          <Badge v-if="lock" :variant="stateVariant(lock.label)" data-lock-state>{{ lock.label }}</Badge>
+          <span class="ml-auto inline-flex items-center gap-2 text-[11px] text-muted-foreground">
+            <template v-if="encryption.nodeId.value">
+              Reported by <NodeLabel :node-id="encryption.nodeId.value" size="sm" />
+            </template>
+            <RefreshButton size="xs" sr-label="Read the encryption state again" :busy="refreshing" @click="encryption.load()" />
+          </span>
+        </header>
+        <div class="space-y-4 px-5 py-4">
+          <p v-if="lock" class="text-xs text-muted-foreground">{{ lock.detail }}</p>
+          <DetailList :items="details" />
+          <div v-if="encrypted" class="flex flex-wrap items-center gap-2 text-xs">
+            <span class="text-muted-foreground">Recovery</span>
+            <Badge :variant="stateVariant(recovery.label)" data-recovery>{{ recovery.label }}</Badge>
+            <span class="text-muted-foreground">{{ recovery.detail }}</span>
+          </div>
+          <Notice tone="info" :lines="permitted" />
+        </div>
+      </section>
+
+      <section v-if="transition" class="surface" data-transition>
+        <header class="flex flex-wrap items-center gap-2 border-b border-border px-5 py-4">
+          <h2 class="font-display text-sm font-semibold text-aruna-navy">{{ transition.title }}</h2>
+          <Badge :variant="stateVariant(transition.state)">{{ transition.state }}</Badge>
+        </header>
+        <div class="space-y-2 px-5 py-4 text-xs text-muted-foreground">
+          <p>{{ transition.detail }}</p>
+          <Notice v-if="status.transition?.blocked_reason" tone="warning">{{ status.transition.blocked_reason }}</Notice>
+        </div>
+      </section>
+
+      <Notice v-if="encrypted" tone="warning" :lines="WARNINGS" />
+    </template>
+  </div>
+</template>
diff --git a/src/views/BucketStorageView.test.ts b/src/views/BucketStorageView.test.ts
index 0a2a3610..563d1325 100644
--- a/src/views/BucketStorageView.test.ts
+++ b/src/views/BucketStorageView.test.ts
@@ -75,6 +75,7 @@ const view = compileClientComponent(new URL('./BucketStorageView.vue', import.me
   '@/components/data/SyncBucketDialog.vue': moduleDefault(Marker('')),
   '@/components/storage/BucketBackendTab.vue': moduleDefault(Marker('backend rules')),
   '@/components/storage/BucketComplianceSection.vue': moduleDefault(Marker('compliance on this node')),
+  '@/components/storage/BucketEncryptionTab.vue': moduleDefault(Marker('encryption state')),
   '@/components/storage/BucketPolicySection.vue': moduleDefault(Marker('where copies may be stored')),
   '@/components/storage/StorageOverviewTab.vue': moduleDefault(Marker('overview details')),
   '@/components/storage/SyncsTab.vue': moduleDefault(Marker('sync rows')),
@@ -130,12 +131,13 @@ describe('bucket storage page', () => {
     const root = await render()
 
     expect(content(root)).toContain('Settings for reef-survey')
-    expect(tabs(root)).toEqual(['overview', 'syncs'])
+    expect(tabs(root)).toEqual(['overview', 'encryption', 'syncs'])
     expect(content(root)).toContain('overview details')
   })
 
   it('opens the tab named in the query', async () => {
     expect(content(await render({ query: { tab: 'syncs' } }))).toContain('sync rows')
+    expect(content(await render({ query: { tab: 'encryption' } }))).toContain('encryption state')
     expect(content(await render({ admin: true, query: { tab: 'backend' } }))).toContain('backend rules')
   })
 
@@ -149,7 +151,7 @@ describe('bucket storage page', () => {
   it('offers the backend and placement tabs to a group admin', async () => {
     const root = await render({ admin: true, query: { tab: 'placement' } })
 
-    expect(tabs(root)).toEqual(['overview', 'backend', 'placement', 'syncs'])
+    expect(tabs(root)).toEqual(['overview', 'backend', 'placement', 'encryption', 'syncs'])
     expect(content(root)).toContain('where copies may be stored')
     expect(content(root)).toContain('compliance on this node')
   })
@@ -157,14 +159,14 @@ describe('bucket storage page', () => {
   it('offers a realm admin placement but not the group routing rules', async () => {
     const root = await render({ realmAdmin: true, query: { tab: 'placement' } })
 
-    expect(tabs(root)).toEqual(['overview', 'placement', 'syncs'])
+    expect(tabs(root)).toEqual(['overview', 'placement', 'encryption', 'syncs'])
     expect(content(root)).toContain('where copies may be stored')
   })
 
   it('names every section the way the settings page calls it', async () => {
     const root = await render({ admin: true })
 
-    expect(tabLabels(root)).toEqual(['Overview', 'Storage backend', 'Placement', 'Syncs'])
+    expect(tabLabels(root)).toEqual(['Overview', 'Storage backend', 'Placement', 'Encryption', 'Syncs'])
   })
 
   it('offers no bucket deletion under the settings tabs', async () => {
@@ -174,7 +176,7 @@ describe('bucket storage page', () => {
   it('hides the node-local tabs for a bucket hosted elsewhere', async () => {
     const root = await render({ admin: true, realmAdmin: true, query: { node: 'node-far', tab: 'syncs' } })
 
-    expect(tabs(root)).toEqual(['overview', 'syncs'])
+    expect(tabs(root)).toEqual(['overview', 'encryption', 'syncs'])
     expect(content(root)).toContain('this node can only show')
   })
 })
diff --git a/src/views/BucketStorageView.vue b/src/views/BucketStorageView.vue
index 425cef7c..14d09542 100644
--- a/src/views/BucketStorageView.vue
+++ b/src/views/BucketStorageView.vue
@@ -18,6 +18,7 @@ import TabsTrigger from '@/components/ui/TabsTrigger.vue'
 import SyncBucketDialog from '@/components/data/SyncBucketDialog.vue'
 import BucketBackendTab from '@/components/storage/BucketBackendTab.vue'
 import BucketComplianceSection from '@/components/storage/BucketComplianceSection.vue'
+import BucketEncryptionTab from '@/components/storage/BucketEncryptionTab.vue'
 import BucketPolicySection from '@/components/storage/BucketPolicySection.vue'
 import StorageOverviewTab from '@/components/storage/StorageOverviewTab.vue'
 import SyncsTab from '@/components/storage/SyncsTab.vue'
@@ -61,7 +62,7 @@ const local = computed(() => !nodeId.value)
 const backendVisible = computed(() => local.value && canAdminGroup.value)
 const placementVisible = computed(() => local.value && (canAdminGroup.value || isRealmAdmin.value))
 
-const TAB_IDS = ['overview', 'backend', 'placement', 'syncs']
+const TAB_IDS = ['overview', 'backend', 'placement', 'encryption', 'syncs']
 const routeTab = useRouteTab(TAB_IDS, 'overview')
 const tab = computed({
   get() {
@@ -122,6 +123,7 @@ const browserLink = computed(() => ({
           <TabsTrigger value="overview">Overview</TabsTrigger>
           <TabsTrigger v-if="backendVisible" value="backend">Storage backend</TabsTrigger>
           <TabsTrigger v-if="placementVisible" value="placement">Placement</TabsTrigger>
+          <TabsTrigger value="encryption">Encryption</TabsTrigger>
           <TabsTrigger value="syncs">Syncs</TabsTrigger>
         </TabsList>
       </div>
@@ -149,6 +151,10 @@ const browserLink = computed(() => ({
         />
       </TabsContent>
 
+      <TabsContent value="encryption" class="mt-0">
+        <BucketEncryptionTab :bucket="bucket" :node-id="nodeId" :group-id="groupId" />
+      </TabsContent>
+
       <TabsContent value="syncs" class="mt-0">
         <Notice v-if="nodeId" tone="info" class="mb-3">
           This bucket is hosted on {{ realmNodes.displayName(nodeId) }}, so this node can only show

From 0798cea9236f4ad8c09b40baa5881567f30d9fd5 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:15:36 +0200
Subject: [PATCH 08/86] feat: unlock, extend and lock a bucket from its
 settings

---
 .../storage/BucketEncryptionTab.test.ts       |  85 +++++++++++-
 .../storage/BucketEncryptionTab.vue           |  71 +++++++++-
 .../storage/BucketUnlockDialog.test.ts        | 125 ++++++++++++++++++
 src/components/storage/BucketUnlockDialog.vue | 122 +++++++++++++++++
 src/lib/bucketEncryption.ts                   |  54 ++++++--
 5 files changed, 442 insertions(+), 15 deletions(-)
 create mode 100644 src/components/storage/BucketUnlockDialog.test.ts
 create mode 100644 src/components/storage/BucketUnlockDialog.vue

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index df5faef5..49a068c5 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -1,15 +1,20 @@
 import { defineComponent, h, ref } from 'vue'
 import * as VueRuntime from 'vue'
-import { describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as Api from '@/lib/api'
 import type { BucketCompressionResponse, BucketEncryptionResponse } from '@/lib/api'
 import * as Wording from '@/lib/bucketEncryption'
 import * as StateBadge from '@/lib/stateBadge'
 import type { EncryptionLoadState } from '@/composables/useBucketEncryption'
-import { compileClientComponent, content, mountApp, moduleDefault } from '@/test/clientRender'
+import { button, click, compileClientComponent, content, mountApp, moduleDefault } from '@/test/clientRender'
 
 const status = ref<BucketEncryptionResponse | null>(null)
 const compression = ref<BucketCompressionResponse | null>(null)
 const state = ref<EncryptionLoadState>('loading')
+const outcomeUnknown = ref(false)
+const lock = vi.fn()
+const extend = vi.fn()
+const unlock = vi.fn()
 
 const Slotted = (tag: string) =>
   defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
@@ -24,14 +29,26 @@ const DetailStub = defineComponent({
     h('dl', (props.items as { label: string; value: string }[]).map((item) => h('p', `${item.label}: ${item.value}`))),
 })
 
+const ButtonStub = defineComponent({
+  inheritAttrs: false,
+  setup: (_, { attrs, slots }) => () => h('button', attrs, slots.default?.()),
+})
+const DialogStub = defineComponent({
+  props: { open: Boolean },
+  setup: (props) => () => h('div', props.open ? 'unlock dialog open' : ''),
+})
+
 const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
   vue: VueRuntime,
   '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
+  '@/components/storage/BucketUnlockDialog.vue': moduleDefault(DialogStub),
   '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
+  '@/components/ui/Button.vue': moduleDefault(ButtonStub),
   '@/components/ui/DetailList.vue': moduleDefault(DetailStub),
   '@/components/ui/NodeLabel.vue': moduleDefault(Slotted('span')),
   '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
   '@/components/ui/RefreshButton.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/Select.vue': moduleDefault(Slotted('select')),
   '@/components/ui/SectionSkeleton.vue': moduleDefault(defineComponent(() => () => h('section', 'loading placeholder'))),
   '@/composables/useBucketEncryption': {
     useBucketEncryption: () => ({
@@ -40,8 +57,13 @@ const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.m
       state,
       error: ref('The node did not answer.'),
       refreshing: ref(false),
+      busy: ref(null),
+      outcomeUnknown,
       nodeId: ref('node-b'),
       load: () => undefined,
+      lock,
+      extend,
+      unlock,
     }),
   },
   '@/lib/bucketEncryption': Wording,
@@ -77,14 +99,33 @@ function encrypted(overrides: Partial<BucketEncryptionResponse> = {}): BucketEnc
   }
 }
 
-async function render(next: EncryptionLoadState, value: BucketEncryptionResponse | null = null) {
+async function mount(next: EncryptionLoadState, value: BucketEncryptionResponse | null = null) {
   state.value = next
   status.value = value
   compression.value = { bucket: 'reef', mode: 'zstd', level: 3, effective_level: 4 }
   const { root } = await mountApp(tab, { props: { bucket: 'reef', nodeId: 'node-b', groupId: 'g-1' } })
-  return content(root)
+  return root
+}
+
+async function render(next: EncryptionLoadState, value: BucketEncryptionResponse | null = null) {
+  return content(await mount(next, value))
+}
+
+const OPEN = {
+  state: 'unlocked' as const,
+  lock_reason: null,
+  locked_at_ms: null,
+  session_id: 'S1',
+  unlocked_at_ms: 1,
+  deadline_ms: 9_000,
+  max_deadline_ms: null,
 }
 
+beforeEach(() => {
+  outcomeUnknown.value = false
+  lock.mockReset().mockResolvedValue(null)
+})
+
 describe('bucket encryption tab', () => {
   it('never shows an unreported state as encryption off', async () => {
     expect(await render('loading')).toContain('loading placeholder')
@@ -137,4 +178,40 @@ describe('bucket encryption tab', () => {
     expect(text).toContain('Compression: zstd level 3')
     expect(text).not.toContain('applied as level')
   })
+
+  it('offers a ready key holder the unlock dialog for a locked bucket', async () => {
+    const root = await mount('ready', encrypted())
+
+    expect(content(root)).not.toContain('Lock now')
+    await click(button(root, 'Unlock'))
+    expect(content(root)).toContain('unlock dialog open')
+  })
+
+  it('offers extend and lock while unlocked and words a refusal', async () => {
+    lock.mockRejectedValueOnce(new Api.ApiError(409, 'conflict', 'session_mismatch'))
+    const root = await mount('ready', encrypted({ unlock: OPEN }))
+
+    expect(content(root)).toContain('Timed unlock')
+    expect(content(root)).toContain('Extend')
+    await click(button(root, 'Lock now'))
+
+    expect(lock).toHaveBeenCalledOnce()
+    expect(content(root)).toContain('locked or unlocked again meanwhile')
+  })
+
+  it('holds back a second unlock while the last one is unconfirmed', async () => {
+    outcomeUnknown.value = true
+    const root = await mount('ready', encrypted())
+
+    expect(content(root)).toContain('The last unlock was not confirmed')
+    expect(button(root, 'Unlock').props.disabled).toBe(true)
+  })
+
+  it('offers a reader no key action', async () => {
+    const reader = { holder: false, ready_copy: false, admin: false }
+    const text = await render('ready', encrypted({ unlock: OPEN, caller: reader }))
+
+    expect(text).toContain('No key action is open to you right now.')
+    expect(text).not.toContain('Lock now')
+  })
 })
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index 03cb4d77..c7c160b7 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -1,18 +1,23 @@
 <script setup lang="ts">
 // The encryption of one bucket as the node that hosts it reports it: mode, lock
 // state, key fingerprint, format, holders, recovery and any rewrite that runs.
-import { computed, toRef } from 'vue'
+import { computed, ref, toRef } from 'vue'
+import BucketUnlockDialog from '@/components/storage/BucketUnlockDialog.vue'
 import Badge from '@/components/ui/Badge.vue'
+import Button from '@/components/ui/Button.vue'
 import DetailList, { type Detail } from '@/components/ui/DetailList.vue'
 import NodeLabel from '@/components/ui/NodeLabel.vue'
 import Notice from '@/components/ui/Notice.vue'
 import RefreshButton from '@/components/ui/RefreshButton.vue'
 import SectionSkeleton from '@/components/ui/SectionSkeleton.vue'
+import Select from '@/components/ui/Select.vue'
 import { useBucketEncryption } from '@/composables/useBucketEncryption'
 import {
   blockKeysLabel,
   cipherLabel,
   compressionSummary,
+  durationOptions,
+  encryptionError,
   holderSummary,
   lockView,
   maxUnlockLabel,
@@ -26,7 +31,7 @@ import { KeyRound } from '@lucide/vue'
 const props = defineProps<{ bucket: string; nodeId: string | null; groupId: string | null }>()
 
 const encryption = useBucketEncryption(toRef(props, 'bucket'), toRef(props, 'nodeId'), toRef(props, 'groupId'))
-const { status, compression, state, error, refreshing } = encryption
+const { status, compression, state, error, refreshing, busy, outcomeUnknown } = encryption
 
 const encrypted = computed(() => Boolean(status.value && status.value.mode !== 'off'))
 const lock = computed(() => (status.value ? lockView(status.value) : null))
@@ -62,6 +67,27 @@ const permitted = computed(() => {
   return lines
 })
 
+const unlockOpen = ref(false)
+const extendBy = ref('')
+const actionError = ref<string | null>(null)
+const unlocked = computed(() => status.value?.unlock?.state === 'unlocked')
+const caller = computed(() => status.value?.caller)
+const canUnlock = computed(
+  () => encrypted.value && status.value?.unlock?.state === 'locked' && Boolean(caller.value?.holder && caller.value.ready_copy),
+)
+const canExtend = computed(() => unlocked.value && Boolean(caller.value?.holder && status.value?.unlock?.session_id))
+const canLock = computed(() => unlocked.value && Boolean(caller.value?.holder || caller.value?.admin))
+const extendOptions = computed(() => durationOptions(status.value?.max_unlock_ms ?? null))
+
+async function act(work: () => Promise<unknown>) {
+  actionError.value = null
+  try {
+    await work()
+  } catch (cause) {
+    actionError.value = encryptionError(cause)
+  }
+}
+
 const WARNINGS = [
   'An unlock lets every reader with access on this node read the bucket until it locks.',
   'A node restart locks vault-locked buckets.',
@@ -121,7 +147,48 @@ const WARNINGS = [
         </div>
       </section>
 
+      <section v-if="encrypted" class="surface" data-key-access>
+        <header class="flex items-center gap-2 border-b border-border px-5 py-4">
+          <h2 class="font-display text-sm font-semibold text-aruna-navy">Key access</h2>
+        </header>
+        <div class="space-y-3 px-5 py-4">
+          <Notice v-if="outcomeUnknown" tone="warning" title="The last unlock was not confirmed">
+            Read the state again before you try once more; the key is never sent twice on its own.
+          </Notice>
+          <div class="flex flex-wrap items-center gap-2">
+            <Button v-if="canUnlock" size="sm" :disabled="Boolean(busy) || outcomeUnknown" @click="unlockOpen = true">
+              Unlock
+            </Button>
+            <template v-if="canExtend">
+              <Select v-model="extendBy" class="w-56" :options="extendOptions" aria-label="Extend the unlock by" />
+              <Button
+                size="sm"
+                variant="outline"
+                :disabled="Boolean(busy)"
+                @click="act(() => encryption.extend(extendBy ? Number(extendBy) : undefined))"
+              >
+                Extend
+              </Button>
+            </template>
+            <Button v-if="canLock" size="sm" variant="outline" :disabled="Boolean(busy)" @click="act(encryption.lock)">
+              Lock now
+            </Button>
+            <span v-if="!canUnlock && !canExtend && !canLock" class="text-xs text-muted-foreground">
+              No key action is open to you right now.
+            </span>
+          </div>
+          <Notice v-if="actionError" tone="error">{{ actionError }}</Notice>
+        </div>
+      </section>
+
       <Notice v-if="encrypted" tone="warning" :lines="WARNINGS" />
+
+      <BucketUnlockDialog
+        v-model:open="unlockOpen"
+        :bucket="bucket"
+        :max-unlock-ms="status.max_unlock_ms"
+        :unlock="encryption.unlock"
+      />
     </template>
   </div>
 </template>
diff --git a/src/components/storage/BucketUnlockDialog.test.ts b/src/components/storage/BucketUnlockDialog.test.ts
new file mode 100644
index 00000000..efef013a
--- /dev/null
+++ b/src/components/storage/BucketUnlockDialog.test.ts
@@ -0,0 +1,125 @@
+import { defineComponent, h, ref } from 'vue'
+import * as VueRuntime from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as Api from '@/lib/api'
+import * as Wording from '@/lib/bucketEncryption'
+import type { VaultState } from '@/composables/useUserVault'
+import {
+  button,
+  click,
+  compileClientComponent,
+  content,
+  element,
+  flush,
+  mountApp,
+  moduleDefault,
+} from '@/test/clientRender'
+
+const vaultState = ref<VaultState>('unlocked')
+const vaultLoaded = ref(true)
+const loadVault = vi.fn()
+const unlock = vi.fn()
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+const NoticeStub = defineComponent({
+  props: { title: String, lines: Array },
+  setup: (props, { slots }) => () =>
+    h('aside', [props.title, slots.default?.(), ...((props.lines as string[] | undefined) ?? []).map((line) => h('p', line))]),
+})
+const SelectStub = defineComponent({
+  inheritAttrs: false,
+  props: { options: Array, modelValue: String },
+  setup: (props, { attrs }) => () =>
+    h('select', attrs, (props.options as { label: string }[]).map((option) => h('option', option.label))),
+})
+
+const dialog = compileClientComponent(new URL('./BucketUnlockDialog.vue', import.meta.url), {
+  vue: VueRuntime,
+  'vue-router': { RouterLink: Slotted('a') },
+  '@/components/settings/VaultUnlockForm.vue': moduleDefault(defineComponent(() => () => h('form', 'passphrase form'))),
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/Dialog.vue': moduleDefault(Slotted('div')),
+  '@/components/ui/DialogContent.vue': moduleDefault(Slotted('div')),
+  '@/components/ui/DialogDescription.vue': moduleDefault(Slotted('p')),
+  '@/components/ui/DialogFooter.vue': moduleDefault(Slotted('footer')),
+  '@/components/ui/DialogHeader.vue': moduleDefault(Slotted('header')),
+  '@/components/ui/DialogTitle.vue': moduleDefault(Slotted('h2')),
+  '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
+  '@/components/ui/Select.vue': moduleDefault(SelectStub),
+  '@/components/ui/Spinner.vue': moduleDefault(Slotted('span')),
+  '@/composables/useUserVault': {
+    useUserVault: () => ({ state: vaultState, loaded: vaultLoaded, error: ref(null), load: loadVault }),
+  },
+  '@/lib/bucketEncryption': Wording,
+})
+
+async function render(maxUnlockMs: number | null = null) {
+  const { root } = await mountApp(dialog, { props: { open: true, bucket: 'reef', maxUnlockMs, unlock } })
+  return root
+}
+
+beforeEach(() => {
+  vaultState.value = 'unlocked'
+  vaultLoaded.value = true
+  loadVault.mockReset()
+  unlock.mockReset().mockResolvedValue({ kind: 'unlocked', status: {}, ownKey: 'matches' })
+})
+
+describe('bucket unlock dialog', () => {
+  it('sends the chosen length within the bucket maximum', async () => {
+    const root = await render(8 * 3_600_000)
+    const select = element(root, (node) => node.tag === 'select')
+
+    expect(content(select)).toBe('The bucket maximum (8h 00m)15 minutes1 hour')
+    ;(select.props['onUpdate:modelValue'] as (value: string) => void)('3600000')
+    await flush()
+    await click(button(root, 'Unlock'))
+
+    expect(unlock).toHaveBeenCalledWith(3_600_000)
+    expect(content(root)).toContain('The node confirmed the unlock.')
+  })
+
+  it('leaves the length to the node when none is chosen and warns about the shared disk', async () => {
+    const root = await render()
+
+    expect(content(root)).toContain('share one disk')
+    await click(button(root, 'Unlock'))
+
+    expect(unlock).toHaveBeenCalledWith(undefined)
+  })
+
+  it('asks for the passphrase first, or points to the vault setup', async () => {
+    vaultState.value = 'locked'
+    const locked = await render()
+    expect(content(locked)).toContain('passphrase form')
+    expect(content(locked)).not.toContain('Unlocking')
+
+    vaultState.value = 'absent'
+    expect(content(await render())).toContain('Set one up in Settings')
+
+    vaultLoaded.value = false
+    await render()
+    expect(loadVault).toHaveBeenCalled()
+  })
+
+  it('says when the node did not confirm, and when the directory key is not this vault', async () => {
+    unlock.mockResolvedValueOnce({ kind: 'unknown', ownKey: 'mismatch' })
+    const root = await render()
+
+    await click(button(root, 'Unlock'))
+
+    expect(content(root)).toContain('The node did not confirm the unlock')
+    expect(content(root)).toContain('names a key that is not in this vault')
+    expect(content(root)).not.toContain('confirmed the unlock.')
+  })
+
+  it('words a refusal from the node', async () => {
+    unlock.mockRejectedValueOnce(new Api.ApiError(400, 'bad', 'wrong_key'))
+    const root = await render()
+
+    await click(button(root, 'Unlock'))
+
+    expect(content(root)).toContain('this key does not belong to the bucket')
+  })
+})
diff --git a/src/components/storage/BucketUnlockDialog.vue b/src/components/storage/BucketUnlockDialog.vue
new file mode 100644
index 00000000..a607f1fd
--- /dev/null
+++ b/src/components/storage/BucketUnlockDialog.vue
@@ -0,0 +1,122 @@
+<script setup lang="ts">
+// Unlocks a bucket from this browser: the vault and the sealed copy open here,
+// and only the bucket key and the chosen length go to the bucket's node.
+import { computed, ref, watch } from 'vue'
+import { RouterLink } from 'vue-router'
+import VaultUnlockForm from '@/components/settings/VaultUnlockForm.vue'
+import Button from '@/components/ui/Button.vue'
+import Dialog from '@/components/ui/Dialog.vue'
+import DialogContent from '@/components/ui/DialogContent.vue'
+import DialogDescription from '@/components/ui/DialogDescription.vue'
+import DialogFooter from '@/components/ui/DialogFooter.vue'
+import DialogHeader from '@/components/ui/DialogHeader.vue'
+import DialogTitle from '@/components/ui/DialogTitle.vue'
+import Notice from '@/components/ui/Notice.vue'
+import Select from '@/components/ui/Select.vue'
+import Spinner from '@/components/ui/Spinner.vue'
+import { useUserVault } from '@/composables/useUserVault'
+import { durationOptions, encryptionError } from '@/lib/bucketEncryption'
+import type { UnlockOutcome } from '@/lib/vault/bucketUnlock'
+
+const props = defineProps<{
+  open: boolean
+  bucket: string
+  maxUnlockMs: number | null
+  unlock: (durationMs?: number) => Promise<UnlockOutcome | null>
+}>()
+const emit = defineEmits<{ (e: 'update:open', open: boolean): void }>()
+
+const { state: vaultState, loaded: vaultLoaded, error: vaultError, load: loadVault } = useUserVault()
+const duration = ref('')
+const busy = ref(false)
+const failure = ref<string | null>(null)
+const outcome = ref<UnlockOutcome | null>(null)
+const options = computed(() => durationOptions(props.maxUnlockMs))
+
+const WARNINGS = [
+  'An unlock lets every reader with access on this node read the bucket until it locks.',
+  'This browser remembers your vault key. On Aruna Desktop the browser and the node share one disk, so that disk can open your bucket keys.',
+]
+const KEY_NOTES: Record<string, string> = {
+  mismatch: 'Your key directory names a key that is not in this vault. Check Settings, Provider keys.',
+  unavailable: 'Your key could not be checked in the key directory, so new copies for you may wait.',
+}
+
+watch(
+  () => props.open,
+  (open) => {
+    if (!open) return
+    duration.value = ''
+    failure.value = null
+    outcome.value = null
+    if (!vaultLoaded.value) void loadVault()
+  },
+  { immediate: true },
+)
+
+async function submit() {
+  busy.value = true
+  failure.value = null
+  try {
+    outcome.value = await props.unlock(duration.value ? Number(duration.value) : undefined)
+    if (!outcome.value) failure.value = 'The bucket changed while it was being unlocked. Nothing was sent.'
+  } catch (cause) {
+    failure.value = encryptionError(cause)
+  } finally {
+    busy.value = false
+  }
+}
+</script>
+
+<template>
+  <Dialog :open="open" @update:open="(value: boolean) => emit('update:open', value)">
+    <DialogContent class="max-w-md">
+      <DialogHeader>
+        <DialogTitle>Unlock {{ bucket }}</DialogTitle>
+        <DialogDescription>
+          Your vault opens your copy of the bucket key in this browser. Only the bucket key and the unlock length go to
+          the node.
+        </DialogDescription>
+      </DialogHeader>
+
+      <div v-if="outcome" class="space-y-3">
+        <Notice v-if="outcome.kind === 'unlocked'" tone="success">The node confirmed the unlock.</Notice>
+        <Notice v-else tone="warning" title="The node did not confirm the unlock">
+          The bucket may or may not be unlocked. The Encryption tab shows what the node reports now; check it before you
+          try again.
+        </Notice>
+        <Notice v-if="KEY_NOTES[outcome.ownKey]" tone="warning">{{ KEY_NOTES[outcome.ownKey] }}</Notice>
+      </div>
+      <div v-else class="space-y-3">
+        <Spinner v-if="!vaultLoaded && !vaultError" show-label label="Opening your vault" />
+        <Notice v-else-if="vaultState === 'unsupported'" tone="warning">
+          This node cannot keep a vault, so no bucket key can be opened here.
+        </Notice>
+        <Notice v-else-if="vaultError && vaultState !== 'unlocked'" tone="error">{{ vaultError }}</Notice>
+        <Notice v-else-if="vaultState === 'absent'" tone="info">
+          You have no vault yet.
+          <RouterLink :to="{ name: 'settings', query: { tab: 'keys' } }" class="font-medium text-primary hover:underline">
+            Set one up in Settings
+          </RouterLink>
+          . Your copy of the bucket key is made at the next unlock by another key holder.
+        </Notice>
+        <VaultUnlockForm v-else-if="vaultState === 'locked'" />
+        <template v-else>
+          <div>
+            <label class="text-xs font-medium text-foreground" for="unlock-length">How long</label>
+            <Select id="unlock-length" v-model="duration" class="mt-1.5" :options="options" aria-label="Unlock length" />
+          </div>
+          <Notice tone="warning" :lines="WARNINGS" />
+        </template>
+        <Notice v-if="failure" tone="error">{{ failure }}</Notice>
+      </div>
+
+      <DialogFooter>
+        <Button variant="outline" size="sm" @click="emit('update:open', false)">{{ outcome ? 'Done' : 'Cancel' }}</Button>
+        <Button v-if="!outcome && vaultState === 'unlocked'" size="sm" :disabled="busy" @click="submit">
+          {{ busy ? 'Unlocking' : 'Unlock' }}
+        </Button>
+      </DialogFooter>
+    </DialogContent>
+  </Dialog>
+</template>
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 67ad3e95..9d18948c 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -1,14 +1,17 @@
 // Words for the encryption state of a bucket. A value the node did not report
 // reads as unknown, never as zero, empty, off or complete.
-import type {
-  BlockCipher,
-  BlockKeys,
-  BucketCompressionResponse,
-  BucketEncryptionResponse,
-  EncryptionMode,
-  EncryptionTransition,
-  HolderReadiness,
-  RecoveryStatus,
+import {
+  ApiError,
+  apiErrorMessage,
+  ENCRYPTION_CODES,
+  type BlockCipher,
+  type BlockKeys,
+  type BucketCompressionResponse,
+  type BucketEncryptionResponse,
+  type EncryptionMode,
+  type EncryptionTransition,
+  type HolderReadiness,
+  type RecoveryStatus,
 } from './api'
 import { formatDuration } from './utils'
 
@@ -153,3 +156,36 @@ export function transitionView(transition: EncryptionTransition): TransitionView
     complete,
   }
 }
+
+const HOUR = 3_600_000
+const DURATIONS: [number, string][] = [
+  [HOUR / 4, '15 minutes'],
+  [HOUR, '1 hour'],
+  [8 * HOUR, '8 hours'],
+  [24 * HOUR, '24 hours'],
+]
+
+/** Unlock lengths within the bucket maximum; '' leaves it to the node: the maximum, or until lock. */
+export function durationOptions(maxMs: number | null): { value: string; label: string }[] {
+  const fallback = maxMs === null ? 'Until lock or restart' : `The bucket maximum (${formatDuration(maxMs)})`
+  const shorter = DURATIONS.filter(([ms]) => maxMs === null || ms < maxMs)
+  return [{ value: '', label: fallback }, ...shorter.map(([ms, label]) => ({ value: String(ms), label }))]
+}
+
+const REFUSALS: Record<string, string> = {
+  [ENCRYPTION_CODES.wrongKey]: 'The node says this key does not belong to the bucket.',
+  [ENCRYPTION_CODES.invalidDuration]: 'The node refused this unlock length.',
+  [ENCRYPTION_CODES.staleGeneration]: 'The bucket key changed meanwhile. Read the state again and retry.',
+  [ENCRYPTION_CODES.sessionMismatch]: 'The bucket was locked or unlocked again meanwhile. Read the state again.',
+  [ENCRYPTION_CODES.capacity]: 'The node holds as many unlocked buckets as it can. Lock another one first.',
+  [ENCRYPTION_CODES.openUploads]: 'Uploads to this bucket are still open. Finish or abort them first.',
+  [ENCRYPTION_CODES.locked]: 'The bucket is locked. A key holder must unlock it first.',
+  [ENCRYPTION_CODES.recoveryUnmet]:
+    'Vault-locked needs two ready key holders, or one with a recovery code.',
+}
+
+/** A node refusal in plain words, by its code; anything else keeps the node's message. */
+export function encryptionError(error: unknown): string {
+  const code = error instanceof ApiError ? (error.code ?? '') : ''
+  return REFUSALS[code] ?? apiErrorMessage(error)
+}

From 4de525ceb347475788cfe52993d8f952c7da5da7 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:16:45 +0200
Subject: [PATCH 09/86] feat: grant and remove bucket key holders with recovery
 confirmation

---
 src/composables/useBucketHolders.test.ts | 104 +++++++++++++++++++++++
 src/composables/useBucketHolders.ts      |  93 ++++++++++++++++++++
 2 files changed, 197 insertions(+)
 create mode 100644 src/composables/useBucketHolders.test.ts
 create mode 100644 src/composables/useBucketHolders.ts

diff --git a/src/composables/useBucketHolders.test.ts b/src/composables/useBucketHolders.test.ts
new file mode 100644
index 00000000..e2d48780
--- /dev/null
+++ b/src/composables/useBucketHolders.test.ts
@@ -0,0 +1,104 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { ref } from 'vue'
+import * as Api from '@/lib/api'
+import type { BucketHolderEntry, BucketHoldersResponse } from '@/lib/api'
+import { breaksRecovery, useBucketHolders } from './useBucketHolders'
+
+const listBucketHolders = vi.fn()
+const removeBucketHolder = vi.fn()
+const grantBucketHolder = vi.fn()
+
+vi.mock('@/lib/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof Api>()),
+  listBucketHolders: (...args: unknown[]) => listBucketHolders(...args),
+  removeBucketHolder: (...args: unknown[]) => removeBucketHolder(...args),
+  grantBucketHolder: (...args: unknown[]) => grantBucketHolder(...args),
+}))
+
+function holder(userId: string, overrides: Partial<BucketHolderEntry> = {}): BucketHolderEntry {
+  return {
+    user_id: userId,
+    origin: 'explicit',
+    state: 'ready',
+    has_recovery: false,
+    granted_by: null,
+    granted_at_ms: null,
+    ...overrides,
+  }
+}
+
+function listing(entries: BucketHolderEntry[], revision = 'rev-1'): BucketHoldersResponse {
+  return { holders: entries, recovery: { state: 'met', ready_holders: 2, ready_with_recovery: 0 }, revision }
+}
+
+const NODE = { baseUrl: 'https://b.test/api/v1', token: 't' }
+let current = true
+const source = { client: () => NODE, binder: () => () => current, load: vi.fn(async () => undefined) }
+
+function refusal(code: string) {
+  return new Api.ApiError(409, 'conflict', code)
+}
+
+beforeEach(() => {
+  current = true
+  source.load.mockClear()
+  listBucketHolders.mockReset().mockResolvedValue(listing([holder('A'), holder('B')]))
+  removeBucketHolder.mockReset().mockResolvedValue(undefined)
+  grantBucketHolder.mockReset().mockResolvedValue(holder('C', { state: 'pending' }))
+})
+
+describe('bucket key holders', () => {
+  it('foresees a removal that breaks recovery', () => {
+    expect(breaksRecovery([holder('A'), holder('B')], 'A')).toBe(true)
+    expect(breaksRecovery([holder('A'), holder('B'), holder('C')], 'A')).toBe(false)
+    expect(breaksRecovery([holder('A'), holder('B', { has_recovery: true })], 'A')).toBe(false)
+    expect(breaksRecovery([holder('A'), holder('B'), holder('C', { state: 'pending' })], 'A')).toBe(true)
+    expect(breaksRecovery([holder('A'), holder('B', { has_recovery: null })], 'A')).toBe(true)
+  })
+
+  it('drops a holder list that arrives after the bucket changed', async () => {
+    const holders = useBucketHolders(source, ref('reef'))
+    current = false
+
+    await holders.load()
+
+    expect(holders.holders.value).toBeNull()
+    expect(holders.state.value).toBe('loading')
+  })
+
+  it('asks for confirmation when the node says the removal breaks recovery', async () => {
+    const holders = useBucketHolders(source, ref('reef'))
+    await holders.load()
+    removeBucketHolder.mockRejectedValueOnce(refusal('recovery_confirmation_required'))
+
+    expect(await holders.remove('A', false)).toBe('confirm')
+    expect(await holders.remove('A', true)).toBe('removed')
+
+    expect(removeBucketHolder.mock.calls.map((call) => call.slice(0, 4))).toEqual([
+      ['reef', 'A', 'rev-1', false],
+      ['reef', 'A', 'rev-1', true],
+    ])
+    expect(source.load).toHaveBeenCalledOnce()
+  })
+
+  it('reloads a holder set that changed meanwhile instead of removing from it', async () => {
+    const holders = useBucketHolders(source, ref('reef'))
+    await holders.load()
+    removeBucketHolder.mockRejectedValueOnce(refusal('stale_holders'))
+    listBucketHolders.mockResolvedValue(listing([holder('A'), holder('B'), holder('C')], 'rev-2'))
+
+    await expect(holders.remove('A', false)).rejects.toThrow('changed meanwhile')
+
+    expect(holders.holders.value?.revision).toBe('rev-2')
+  })
+
+  it('grants a holder and reads both the list and the bucket status again', async () => {
+    const holders = useBucketHolders(source, ref('reef'))
+
+    await holders.grant('C')
+
+    expect(grantBucketHolder.mock.calls[0].slice(0, 2)).toEqual(['reef', 'C'])
+    expect(listBucketHolders).toHaveBeenCalledOnce()
+    expect(source.load).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/composables/useBucketHolders.ts b/src/composables/useBucketHolders.ts
new file mode 100644
index 00000000..50f3b8c9
--- /dev/null
+++ b/src/composables/useBucketHolders.ts
@@ -0,0 +1,93 @@
+// Key holders of one encrypted bucket, asked of the node that hosts it. Removal
+// names the holder revision it saw, so a changed set is refused, and breaking
+// the recovery rule needs an explicit confirmation.
+import { ref, type Ref } from 'vue'
+import {
+  ApiError,
+  ENCRYPTION_CODES,
+  encryptionRefusal,
+  grantBucketHolder,
+  listBucketHolders,
+  removeBucketHolder,
+  type ApiClientOptions,
+  type BucketHolderEntry,
+  type BucketHoldersResponse,
+} from '@/lib/api'
+import { encryptionError } from '@/lib/bucketEncryption'
+
+export interface HolderSource {
+  client(): ApiClientOptions
+  binder(): () => boolean
+  load(): Promise<void>
+}
+
+export type HoldersState = 'loading' | 'ready' | 'refused' | 'failed'
+export type RemovalResult = 'removed' | 'confirm'
+
+/** True when removing `userId` would leave fewer than two ready holders and no ready recovery code. */
+export function breaksRecovery(holders: BucketHolderEntry[], userId: string): boolean {
+  const remaining = holders.filter((holder) => holder.user_id !== userId && holder.state === 'ready')
+  const ready = new Set(remaining.map((holder) => holder.user_id))
+  return ready.size < 2 && !remaining.some((holder) => holder.has_recovery === true)
+}
+
+export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
+  const holders = ref<BucketHoldersResponse | null>(null)
+  const state = ref<HoldersState>('loading')
+  const error = ref<string | null>(null)
+  let loads = 0
+
+  async function load(): Promise<void> {
+    const run = ++loads
+    const bound = source.binder()
+    state.value = holders.value ? state.value : 'loading'
+    try {
+      const response = await listBucketHolders(bucket.value, source.client())
+      if (!bound() || run !== loads) return
+      holders.value = response
+      state.value = 'ready'
+      error.value = null
+    } catch (cause) {
+      if (!bound() || run !== loads) return
+      holders.value = null
+      const refused = cause instanceof ApiError && (cause.status === 401 || cause.status === 403)
+      state.value = refused ? 'refused' : 'failed'
+      error.value = encryptionError(cause)
+    }
+  }
+
+  async function refresh(bound: () => boolean) {
+    if (!bound()) return
+    await Promise.all([load(), source.load()])
+  }
+
+  async function grant(userId: string): Promise<void> {
+    const bound = source.binder()
+    try {
+      await grantBucketHolder(bucket.value, userId, source.client())
+    } finally {
+      await refresh(bound)
+    }
+  }
+
+  /** Without `confirmRecovery`, a removal that breaks recovery comes back as `confirm`. */
+  async function remove(userId: string, confirmRecovery: boolean): Promise<RemovalResult> {
+    const revision = holders.value?.revision
+    if (!revision) throw new Error('The key holders are not known yet.')
+    const bound = source.binder()
+    try {
+      await removeBucketHolder(bucket.value, userId, revision, confirmRecovery, source.client())
+    } catch (cause) {
+      if (encryptionRefusal(cause, 409, ENCRYPTION_CODES.confirmRecovery)) return 'confirm'
+      if (encryptionRefusal(cause, 409, ENCRYPTION_CODES.staleHolders)) {
+        await refresh(bound)
+        throw new Error('The key holders changed meanwhile. Check the list and try again.')
+      }
+      throw cause
+    }
+    await refresh(bound)
+    return 'removed'
+  }
+
+  return { holders, state, error, load, grant, remove }
+}

From 868866e08b1a464bf9c5f799176272c9a7e24f9e Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:18:29 +0200
Subject: [PATCH 10/86] feat: list bucket key holders and confirm a removal
 that breaks recovery

---
 .../storage/BucketEncryptionTab.test.ts       |   3 +
 .../storage/BucketEncryptionTab.vue           |   8 +
 .../storage/BucketHoldersSection.test.ts      | 125 ++++++++++++
 .../storage/BucketHoldersSection.vue          | 181 ++++++++++++++++++
 src/lib/bucketEncryption.ts                   |  15 ++
 src/lib/stateBadge.ts                         |   2 +
 6 files changed, 334 insertions(+)
 create mode 100644 src/components/storage/BucketHoldersSection.test.ts
 create mode 100644 src/components/storage/BucketHoldersSection.vue

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index 49a068c5..8e02bdd9 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -41,6 +41,7 @@ const DialogStub = defineComponent({
 const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
   vue: VueRuntime,
   '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
+  '@/components/storage/BucketHoldersSection.vue': moduleDefault(defineComponent(() => () => h('section', 'holder list'))),
   '@/components/storage/BucketUnlockDialog.vue': moduleDefault(DialogStub),
   '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
   '@/components/ui/Button.vue': moduleDefault(ButtonStub),
@@ -213,5 +214,7 @@ describe('bucket encryption tab', () => {
 
     expect(text).toContain('No key action is open to you right now.')
     expect(text).not.toContain('Lock now')
+    expect(text).not.toContain('holder list')
+    expect(await render('ready', encrypted())).toContain('holder list')
   })
 })
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index c7c160b7..b6811a29 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -2,6 +2,7 @@
 // The encryption of one bucket as the node that hosts it reports it: mode, lock
 // state, key fingerprint, format, holders, recovery and any rewrite that runs.
 import { computed, ref, toRef } from 'vue'
+import BucketHoldersSection from '@/components/storage/BucketHoldersSection.vue'
 import BucketUnlockDialog from '@/components/storage/BucketUnlockDialog.vue'
 import Badge from '@/components/ui/Badge.vue'
 import Button from '@/components/ui/Button.vue'
@@ -181,6 +182,13 @@ const WARNINGS = [
         </div>
       </section>
 
+      <BucketHoldersSection
+        v-if="encrypted && (caller?.holder || caller?.admin)"
+        :bucket="bucket"
+        :can-manage="Boolean(caller?.admin)"
+        :source="encryption"
+      />
+
       <Notice v-if="encrypted" tone="warning" :lines="WARNINGS" />
 
       <BucketUnlockDialog
diff --git a/src/components/storage/BucketHoldersSection.test.ts b/src/components/storage/BucketHoldersSection.test.ts
new file mode 100644
index 00000000..325c827a
--- /dev/null
+++ b/src/components/storage/BucketHoldersSection.test.ts
@@ -0,0 +1,125 @@
+import { defineComponent, h, ref } from 'vue'
+import * as VueRuntime from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BucketHolderEntry, BucketHoldersResponse } from '@/lib/api'
+import * as Wording from '@/lib/bucketEncryption'
+import * as StateBadge from '@/lib/stateBadge'
+import * as Utils from '@/lib/utils'
+import { breaksRecovery, type HoldersState } from '@/composables/useBucketHolders'
+import { button, click, compileClientComponent, content, element, mountApp, moduleDefault } from '@/test/clientRender'
+
+const holders = ref<BucketHoldersResponse | null>(null)
+const state = ref<HoldersState>('ready')
+const remove = vi.fn()
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+const DialogStub = defineComponent({
+  props: { open: Boolean },
+  setup: (props, { slots }) => () => (props.open ? h('div', { 'data-dialog': true }, slots.default?.()) : null),
+})
+
+const section = compileClientComponent(new URL('./BucketHoldersSection.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@vueuse/core': { useDebounceFn: (run: (...args: unknown[]) => unknown) => run },
+  '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/Dialog.vue': moduleDefault(DialogStub),
+  '@/components/ui/DialogContent.vue': moduleDefault(Slotted('div')),
+  '@/components/ui/DialogDescription.vue': moduleDefault(Slotted('p')),
+  '@/components/ui/DialogFooter.vue': moduleDefault(Slotted('footer')),
+  '@/components/ui/DialogHeader.vue': moduleDefault(Slotted('header')),
+  '@/components/ui/DialogTitle.vue': moduleDefault(Slotted('h2')),
+  '@/components/ui/Input.vue': moduleDefault(Slotted('input')),
+  '@/components/ui/Notice.vue': moduleDefault(Slotted('aside')),
+  '@/components/ui/Spinner.vue': moduleDefault(defineComponent(() => () => h('span', 'loading'))),
+  '@/composables/useAruna': { useAruna: () => ({ searchUsers: async () => ({ users: [] }) }) },
+  '@/composables/useBucketHolders': {
+    breaksRecovery,
+    useBucketHolders: () => ({ holders, state, error: ref('The directory did not answer.'), load: vi.fn(), grant: vi.fn(), remove }),
+  },
+  '@/lib/bucketEncryption': Wording,
+  '@/lib/stateBadge': StateBadge,
+  '@/lib/utils': Utils,
+})
+
+function holder(userId: string, overrides: Partial<BucketHolderEntry> = {}): BucketHolderEntry {
+  return { user_id: userId, name: userId, origin: 'explicit', state: 'ready', has_recovery: false, granted_by: null, granted_at_ms: null, ...overrides }
+}
+
+async function render(entries: BucketHolderEntry[], canManage = true) {
+  holders.value = { holders: entries, recovery: { state: 'met', ready_holders: 2, ready_with_recovery: 0 }, revision: 'rev-1' }
+  const source = { client: () => ({}), binder: () => () => true, load: async () => undefined }
+  const { root } = await mountApp(section, { props: { bucket: 'reef', canManage, source } })
+  return root
+}
+
+function rowButton(root: Awaited<ReturnType<typeof render>>, name: string) {
+  const row = element(root, (node) => node.tag === 'li' && content(node).startsWith(name))
+  return button(row, 'Remove')
+}
+
+beforeEach(() => {
+  state.value = 'ready'
+  remove.mockReset().mockResolvedValue('removed')
+})
+
+describe('bucket key holder list', () => {
+  it('shows each holder with origin, readiness and recovery code, and removes only grants', async () => {
+    const root = await render([
+      holder('Ada', { origin: 'creator', has_recovery: true }),
+      holder('Bo', { state: 'missing_key', has_recovery: null }),
+      holder('Cy', { state: 'pending' }),
+    ])
+    const text = content(root)
+
+    expect(text).toContain('Creator')
+    expect(text).toContain('No usable key')
+    expect(text).toContain('Recovery code: unknown')
+    expect(text).toContain('Recovery: Met')
+    expect(text).toContain('does not erase copies')
+    expect(() => rowButton(root, 'Ada')).toThrow()
+    await click(rowButton(root, 'Cy'))
+    expect(remove).toHaveBeenCalledWith('Cy', false)
+  })
+
+  it('asks before a removal that breaks recovery and sends the confirmation', async () => {
+    const root = await render([holder('Ada'), holder('Bo')])
+
+    await click(rowButton(root, 'Bo'))
+    expect(remove).not.toHaveBeenCalled()
+    expect(content(root)).toContain('cannot be read again')
+    expect(button(root, 'Remove anyway').props.disabled).toBe(true)
+    await click(element(root, (node) => node.tag === 'input' && node.props.type === 'checkbox'))
+    await click(button(root, 'Remove anyway'))
+
+    expect(remove).toHaveBeenCalledWith('Bo', true)
+  })
+
+  it('asks when the node says the removal breaks recovery', async () => {
+    remove.mockResolvedValueOnce('confirm')
+    const root = await render([holder('Ada'), holder('Bo'), holder('Cy')])
+
+    await click(rowButton(root, 'Cy'))
+
+    expect(remove).toHaveBeenCalledWith('Cy', false)
+    expect(content(root)).toContain('Remove Cy?')
+  })
+
+  it('offers no changes to a key holder who is not a group admin', async () => {
+    const root = await render([holder('Ada'), holder('Bo')], false)
+
+    expect(content(root)).not.toContain('Grant a key holder')
+    expect(() => rowButton(root, 'Bo')).toThrow()
+  })
+
+  it('never shows a holder list it could not read as empty', async () => {
+    state.value = 'failed'
+    holders.value = null
+    const source = { client: () => ({}), binder: () => () => true, load: async () => undefined }
+    const { root } = await mountApp(section, { props: { bucket: 'reef', canManage: true, source } })
+
+    expect(content(root)).toContain('The key holders are unknown.')
+    expect(content(root)).not.toContain('no key holders')
+  })
+})
diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
new file mode 100644
index 00000000..af6759f6
--- /dev/null
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -0,0 +1,181 @@
+<script setup lang="ts">
+// Who may unlock this bucket, how ready their key copy is, and whether the
+// recovery rule holds. Group admins grant and remove explicit key holders.
+import { computed, ref, toRef, watch } from 'vue'
+import { useDebounceFn } from '@vueuse/core'
+import Badge from '@/components/ui/Badge.vue'
+import Button from '@/components/ui/Button.vue'
+import Dialog from '@/components/ui/Dialog.vue'
+import DialogContent from '@/components/ui/DialogContent.vue'
+import DialogDescription from '@/components/ui/DialogDescription.vue'
+import DialogFooter from '@/components/ui/DialogFooter.vue'
+import DialogHeader from '@/components/ui/DialogHeader.vue'
+import DialogTitle from '@/components/ui/DialogTitle.vue'
+import Input from '@/components/ui/Input.vue'
+import Notice from '@/components/ui/Notice.vue'
+import Spinner from '@/components/ui/Spinner.vue'
+import { useAruna } from '@/composables/useAruna'
+import { breaksRecovery, useBucketHolders, type HolderSource } from '@/composables/useBucketHolders'
+import type { BucketHolderEntry, UserSearchHit } from '@/lib/api'
+import { HOLDER_STATE_LABEL, ORIGIN_LABEL, encryptionError, recoverySummary } from '@/lib/bucketEncryption'
+import { stateVariant } from '@/lib/stateBadge'
+import { shortUserId } from '@/lib/utils'
+
+const props = defineProps<{ bucket: string; canManage: boolean; source: HolderSource }>()
+
+const { searchUsers } = useAruna()
+const { holders, state, error, load, grant, remove } = useBucketHolders(props.source, toRef(props, 'bucket'))
+watch(() => props.bucket, () => void load(), { immediate: true })
+
+const list = computed(() => holders.value?.holders ?? [])
+const recovery = computed(() => recoverySummary(holders.value?.recovery ?? null))
+const busy = ref<string | null>(null)
+const failure = ref<string | null>(null)
+const pending = ref<BucketHolderEntry | null>(null)
+const accepted = ref(false)
+
+const query = ref('')
+const results = ref<UserSearchHit[]>([])
+const chosen = ref<UserSearchHit | null>(null)
+let searches = 0
+const runSearch = useDebounceFn(async (term: string, run: number) => {
+  if (term.length < 2 || run !== searches) return
+  const response = await searchUsers(term).catch(() => ({ users: [] }))
+  if (run === searches) results.value = response.users.filter((hit) => !list.value.some((h) => h.user_id === hit.user_id))
+}, 250)
+watch(query, (term) => {
+  if (chosen.value && term === chosen.value.name) return
+  chosen.value = null
+  results.value = []
+  void runSearch(term.trim(), ++searches)
+})
+
+function nameOf(entry: BucketHolderEntry): string {
+  return entry.name || shortUserId(entry.user_id)
+}
+
+async function addHolder() {
+  if (!chosen.value) return
+  busy.value = chosen.value.user_id
+  failure.value = null
+  try {
+    await grant(chosen.value.user_id)
+    query.value = ''
+    chosen.value = null
+  } catch (cause) {
+    failure.value = encryptionError(cause)
+  } finally {
+    busy.value = null
+  }
+}
+
+async function removeHolder(entry: BucketHolderEntry, confirm: boolean) {
+  busy.value = entry.user_id
+  failure.value = null
+  try {
+    const result = await remove(entry.user_id, confirm)
+    pending.value = result === 'confirm' ? entry : null
+    accepted.value = false
+  } catch (cause) {
+    failure.value = encryptionError(cause)
+  } finally {
+    busy.value = null
+  }
+}
+
+function startRemove(entry: BucketHolderEntry) {
+  if (breaksRecovery(list.value, entry.user_id)) {
+    accepted.value = false
+    pending.value = entry
+  } else void removeHolder(entry, false)
+}
+</script>
+
+<template>
+  <section class="surface" data-holders>
+    <header class="flex flex-wrap items-center gap-2 border-b border-border px-5 py-4">
+      <h2 class="font-display text-sm font-semibold text-aruna-navy">Key holders</h2>
+      <Badge v-if="holders" :variant="stateVariant(recovery.label)">Recovery: {{ recovery.label }}</Badge>
+    </header>
+    <div class="space-y-3 px-5 py-4">
+      <Spinner v-if="state === 'loading'" show-label label="Loading the key holders" />
+      <Notice v-else-if="state === 'refused'" tone="info">Only key holders and group admins see the key holders.</Notice>
+      <Notice v-else-if="state === 'failed'" tone="error" :title="error ?? undefined">The key holders are unknown.</Notice>
+      <template v-else-if="holders">
+        <p class="text-xs text-muted-foreground">{{ recovery.detail }}</p>
+        <ul class="divide-y divide-border text-sm">
+          <li v-for="entry in list" :key="entry.user_id" class="flex flex-wrap items-center gap-2 py-2">
+            <span class="min-w-0 flex-1 truncate" :title="entry.user_id">{{ nameOf(entry) }}</span>
+            <span class="text-xs text-muted-foreground">{{ ORIGIN_LABEL[entry.origin] ?? entry.origin }}</span>
+            <Badge :variant="stateVariant(HOLDER_STATE_LABEL[entry.state] ?? 'unknown')">
+              {{ HOLDER_STATE_LABEL[entry.state] ?? 'Unknown' }}
+            </Badge>
+            <span class="text-xs text-muted-foreground">
+              Recovery code: {{ entry.has_recovery === null ? 'unknown' : entry.has_recovery ? 'yes' : 'no' }}
+            </span>
+            <Button
+              v-if="canManage && entry.origin === 'explicit'"
+              size="sm"
+              variant="outline"
+              :disabled="busy !== null"
+              @click="startRemove(entry)"
+            >
+              Remove
+            </Button>
+          </li>
+        </ul>
+        <p v-if="!list.length" class="text-xs text-muted-foreground">This bucket has no key holders.</p>
+        <Notice tone="warning">Removing a key holder does not erase copies of the key they already made.</Notice>
+      </template>
+
+      <div v-if="canManage" class="space-y-1.5">
+        <label class="text-xs font-medium text-foreground" for="holder-search">Grant a key holder</label>
+        <div class="relative flex gap-2">
+          <Input id="holder-search" v-model="query" placeholder="Search users (min 2 characters)" />
+          <Button size="sm" :disabled="!chosen || busy !== null" @click="addHolder">Grant</Button>
+          <div v-if="results.length && !chosen" class="absolute top-10 z-10 w-full rounded-md border border-border bg-popover shadow-md">
+            <button
+              v-for="hit in results"
+              :key="hit.user_id"
+              type="button"
+              class="flex w-full justify-between px-3 py-1.5 text-left text-sm hover:bg-muted"
+              @click="chosen = hit; query = hit.name"
+            >
+              <span class="truncate">{{ hit.name }}</span>
+              <span class="font-mono text-[10px] text-muted-foreground">{{ shortUserId(hit.user_id) }}</span>
+            </button>
+          </div>
+        </div>
+        <p class="text-[11px] text-muted-foreground">The new key holder gets a copy at the next unlock.</p>
+      </div>
+      <Notice v-if="failure" tone="error">{{ failure }}</Notice>
+    </div>
+
+    <Dialog :open="Boolean(pending)" @update:open="(open: boolean) => !open && (pending = null)">
+      <DialogContent class="max-w-md">
+        <DialogHeader>
+          <DialogTitle>Remove {{ pending ? nameOf(pending) : '' }}?</DialogTitle>
+          <DialogDescription>
+            After this removal the bucket has fewer than two ready key holders and none with a recovery code. If the
+            last key is lost, the data in this bucket cannot be read again.
+          </DialogDescription>
+        </DialogHeader>
+        <label class="flex items-start gap-2 text-xs text-muted-foreground">
+          <input type="checkbox" class="mt-0.5" :checked="accepted" @click="accepted = !accepted" />
+          <span>I accept that recovery is no longer possible.</span>
+        </label>
+        <DialogFooter>
+          <Button variant="outline" size="sm" @click="pending = null">Cancel</Button>
+          <Button
+            variant="destructive"
+            size="sm"
+            :disabled="!accepted || busy !== null"
+            @click="pending && removeHolder(pending, true)"
+          >
+            Remove anyway
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </section>
+</template>
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 9d18948c..8c52e71b 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -10,7 +10,9 @@ import {
   type BucketEncryptionResponse,
   type EncryptionMode,
   type EncryptionTransition,
+  type HolderOrigin,
   type HolderReadiness,
+  type HolderState,
   type RecoveryStatus,
 } from './api'
 import { formatDuration } from './utils'
@@ -31,6 +33,19 @@ export const BLOCK_KEYS_LABEL: Record<BlockKeys, string> = {
   unique: 'A new key for every block',
 }
 
+export const ORIGIN_LABEL: Record<HolderOrigin, string> = {
+  creator: 'Creator',
+  admin: 'Group admin',
+  explicit: 'Granted',
+}
+
+export const HOLDER_STATE_LABEL: Record<HolderState, string> = {
+  ready: 'Ready',
+  pending: 'Pending',
+  missing_key: 'No usable key',
+  unavailable: 'Directory unavailable',
+}
+
 const UNKNOWN = 'Unknown'
 
 function known<T extends string>(labels: Record<T, string>, value: T | null | undefined): string {
diff --git a/src/lib/stateBadge.ts b/src/lib/stateBadge.ts
index a3cb71e4..d752e185 100644
--- a/src/lib/stateBadge.ts
+++ b/src/lib/stateBadge.ts
@@ -108,6 +108,8 @@ const STATE_TONE: Record<string, StateTone> = {
   'removing old copies': 'progress',
   'waiting for an unlock': 'attention',
   blocked: 'attention',
+  'no usable key': 'attention',
+  'directory unavailable': 'attention',
 }
 
 /** The tone for a state string; anything unknown reads as a neutral count. */

From cfb4ae12cc82602aa9ad2e3b82d1b470e7e164e4 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:20:51 +0200
Subject: [PATCH 11/86] feat: change the bucket encryption mode and rotate its
 key

---
 .../storage/BucketEncryptionSettings.test.ts  | 122 +++++++++++++++
 .../storage/BucketEncryptionSettings.vue      | 144 ++++++++++++++++++
 .../storage/BucketEncryptionTab.test.ts       |   4 +
 .../storage/BucketEncryptionTab.vue           |   9 ++
 src/lib/bucketEncryption.test.ts              |  16 ++
 src/lib/bucketEncryption.ts                   |  58 +++++++
 6 files changed, 353 insertions(+)
 create mode 100644 src/components/storage/BucketEncryptionSettings.test.ts
 create mode 100644 src/components/storage/BucketEncryptionSettings.vue

diff --git a/src/components/storage/BucketEncryptionSettings.test.ts b/src/components/storage/BucketEncryptionSettings.test.ts
new file mode 100644
index 00000000..39ff088e
--- /dev/null
+++ b/src/components/storage/BucketEncryptionSettings.test.ts
@@ -0,0 +1,122 @@
+import { defineComponent, h } from 'vue'
+import * as VueRuntime from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as Api from '@/lib/api'
+import type { BucketEncryptionResponse } from '@/lib/api'
+import * as Wording from '@/lib/bucketEncryption'
+import { button, click, compileClientComponent, content, element, flush, mountApp, moduleDefault } from '@/test/clientRender'
+
+const save = vi.fn()
+const rotate = vi.fn()
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+const NoticeStub = defineComponent({
+  props: { lines: Array },
+  setup: (props, { slots }) => () =>
+    h('aside', [slots.default?.(), ...((props.lines as string[] | undefined) ?? []).map((line) => h('p', line))]),
+})
+const DialogStub = defineComponent({
+  props: { open: Boolean },
+  setup: (props, { slots }) => () => (props.open ? h('div', { 'data-dialog': true }, slots.default?.()) : null),
+})
+
+const settings = compileClientComponent(new URL('./BucketEncryptionSettings.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/Dialog.vue': moduleDefault(DialogStub),
+  '@/components/ui/DialogContent.vue': moduleDefault(Slotted('div')),
+  '@/components/ui/DialogDescription.vue': moduleDefault(Slotted('p')),
+  '@/components/ui/DialogFooter.vue': moduleDefault(Slotted('footer')),
+  '@/components/ui/DialogHeader.vue': moduleDefault(Slotted('header')),
+  '@/components/ui/DialogTitle.vue': moduleDefault(Slotted('h2')),
+  '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
+  '@/components/ui/Select.vue': moduleDefault(Slotted('select')),
+  '@/lib/bucketEncryption': Wording,
+})
+
+function status(overrides: Partial<BucketEncryptionResponse> = {}): BucketEncryptionResponse {
+  return {
+    bucket: 'reef',
+    mode: 'node_managed',
+    bucket_id: 'B1',
+    storage_generation: 1,
+    key_generation: 5,
+    public_key: 'PK',
+    fingerprint: 'ff',
+    cipher: 'chacha20_poly1305',
+    block_keys: 'content_derived',
+    max_unlock_ms: null,
+    unlock: { state: 'locked', lock_reason: 'manual', locked_at_ms: 1, session_id: null, unlocked_at_ms: null, deadline_ms: null, max_deadline_ms: null },
+    holders: null,
+    recovery: null,
+    transition: null,
+    caller: { holder: true, ready_copy: true, admin: true },
+    ...overrides,
+  }
+}
+
+const UNLOCKED = { state: 'unlocked' as const, lock_reason: null, locked_at_ms: null, session_id: 'S', unlocked_at_ms: 1, deadline_ms: null, max_deadline_ms: null }
+
+async function render(value: BucketEncryptionResponse) {
+  const { root } = await mountApp(settings, { props: { status: value, busy: false, save, rotate } })
+  return root
+}
+
+function dialog(root: Awaited<ReturnType<typeof render>>) {
+  return element(root, (node) => node.props['data-dialog'] === true)
+}
+
+async function choose(root: Awaited<ReturnType<typeof render>>, label: string, value: string) {
+  const select = element(root, (node) => node.tag === 'select' && node.props['aria-label'] === label)
+  ;(select.props['onUpdate:modelValue'] as (next: string) => void)(value)
+  await flush()
+}
+
+beforeEach(() => {
+  save.mockReset().mockResolvedValue(undefined)
+  rotate.mockReset().mockResolvedValue(undefined)
+})
+
+describe('bucket encryption settings', () => {
+  it('holds back a change that needs the key while the bucket is locked', async () => {
+    const root = await render(status())
+
+    await choose(root, 'Encryption mode', 'vault_locked')
+
+    expect(content(root)).toContain('Unlock the bucket first')
+    expect(content(root)).toContain('the node copy is removed')
+    expect(button(root, 'Save changes').props.disabled).toBe(true)
+    expect(button(root, 'Rotate key').props.disabled).toBe(true)
+  })
+
+  it('confirms a change with its notes and sends the key generation it saw', async () => {
+    const root = await render(status({ mode: 'off', unlock: null }))
+
+    await choose(root, 'Encryption mode', 'vault_locked')
+    await click(button(root, 'Save changes'))
+    expect(content(root)).toContain('no unlock is needed')
+    expect(content(root)).toContain('A node restart locks the bucket.')
+    await click(button(dialog(root), 'Save'))
+
+    expect(save).toHaveBeenCalledWith({
+      mode: 'vault_locked',
+      cipher: 'chacha20_poly1305',
+      block_keys: 'content_derived',
+      max_unlock_ms: null,
+      expected_generation: 5,
+    })
+  })
+
+  it('rotates an unlocked bucket after the backup warning and words a refusal', async () => {
+    rotate.mockRejectedValueOnce(new Api.ApiError(409, 'busy', 'open_uploads'))
+    const root = await render(status({ unlock: UNLOCKED }))
+
+    await click(button(root, 'Rotate key'))
+    expect(content(root)).toContain('does not invalidate an old backup')
+    await click(button(dialog(root), 'Rotate'))
+
+    expect(rotate).toHaveBeenCalledOnce()
+    expect(content(root)).toContain('Uploads to this bucket are still open')
+  })
+})
diff --git a/src/components/storage/BucketEncryptionSettings.vue b/src/components/storage/BucketEncryptionSettings.vue
new file mode 100644
index 00000000..6c8f97f6
--- /dev/null
+++ b/src/components/storage/BucketEncryptionSettings.vue
@@ -0,0 +1,144 @@
+<script setup lang="ts">
+// Group-admin controls: the encryption mode and format of new writes, the
+// longest unlock, and key rotation. Each change is confirmed with its notes.
+import { computed, ref, watch } from 'vue'
+import Button from '@/components/ui/Button.vue'
+import Dialog from '@/components/ui/Dialog.vue'
+import DialogContent from '@/components/ui/DialogContent.vue'
+import DialogDescription from '@/components/ui/DialogDescription.vue'
+import DialogFooter from '@/components/ui/DialogFooter.vue'
+import DialogHeader from '@/components/ui/DialogHeader.vue'
+import DialogTitle from '@/components/ui/DialogTitle.vue'
+import Notice from '@/components/ui/Notice.vue'
+import Select from '@/components/ui/Select.vue'
+import type { BlockCipher, BlockKeys, BucketEncryptionResponse, EncryptionMode } from '@/lib/api'
+import {
+  BLOCK_KEYS_LABEL,
+  CIPHER_LABEL,
+  MODE_LABEL,
+  ROTATION_NOTES,
+  changeNeedsUnlock,
+  changeNotes,
+  encryptionError,
+  maxUnlockOptions,
+  type EncryptionDraft,
+} from '@/lib/bucketEncryption'
+
+const props = defineProps<{
+  status: BucketEncryptionResponse
+  busy: boolean
+  save: (request: EncryptionDraft & { expected_generation: number }) => Promise<unknown>
+  rotate: () => Promise<unknown>
+}>()
+
+const mode = ref<EncryptionMode>('off')
+const cipher = ref<BlockCipher>('chacha20_poly1305')
+const blockKeys = ref<BlockKeys>('content_derived')
+const maxUnlock = ref('')
+const confirming = ref<'save' | 'rotate' | null>(null)
+const failure = ref<string | null>(null)
+
+function reset() {
+  mode.value = props.status.mode
+  cipher.value = props.status.cipher
+  blockKeys.value = props.status.block_keys
+  maxUnlock.value = props.status.max_unlock_ms === null ? '' : String(props.status.max_unlock_ms)
+}
+watch(() => props.status, reset, { immediate: true })
+
+const options = (labels: Record<string, string>) => Object.entries(labels).map(([value, label]) => ({ value, label }))
+const draft = computed<EncryptionDraft>(() => ({
+  mode: mode.value,
+  cipher: cipher.value,
+  block_keys: blockKeys.value,
+  max_unlock_ms: maxUnlock.value ? Number(maxUnlock.value) : null,
+}))
+const changed = computed(
+  () =>
+    draft.value.mode !== props.status.mode ||
+    draft.value.cipher !== props.status.cipher ||
+    draft.value.block_keys !== props.status.block_keys ||
+    draft.value.max_unlock_ms !== props.status.max_unlock_ms,
+)
+const locked = computed(() => props.status.unlock?.state !== 'unlocked')
+const blockedByLock = computed(() => locked.value && changeNeedsUnlock(props.status, draft.value))
+const notes = computed(() => changeNotes(props.status, draft.value))
+const canRotate = computed(() => props.status.mode !== 'off' && !locked.value)
+
+async function confirm() {
+  const action = confirming.value
+  failure.value = null
+  try {
+    if (action === 'save') await props.save({ ...draft.value, expected_generation: props.status.key_generation })
+    else if (action === 'rotate') await props.rotate()
+    confirming.value = null
+  } catch (cause) {
+    failure.value = encryptionError(cause)
+  }
+}
+</script>
+
+<template>
+  <section class="surface" data-encryption-settings>
+    <header class="flex items-center gap-2 border-b border-border px-5 py-4">
+      <h2 class="font-display text-sm font-semibold text-aruna-navy">Encryption settings</h2>
+    </header>
+    <div class="space-y-3 px-5 py-4">
+      <div class="grid gap-3 sm:grid-cols-2">
+        <label class="text-xs font-medium text-foreground">
+          Mode
+          <Select v-model="mode" class="mt-1.5" :options="options(MODE_LABEL)" aria-label="Encryption mode" />
+        </label>
+        <label class="text-xs font-medium text-foreground">
+          Longest unlock
+          <Select v-model="maxUnlock" class="mt-1.5" :options="maxUnlockOptions(status.max_unlock_ms)" aria-label="Longest unlock" />
+        </label>
+        <label v-if="mode !== 'off'" class="text-xs font-medium text-foreground">
+          Cipher
+          <Select v-model="cipher" class="mt-1.5" :options="options(CIPHER_LABEL)" aria-label="Cipher" />
+        </label>
+        <label v-if="mode !== 'off'" class="text-xs font-medium text-foreground">
+          Block keys
+          <Select v-model="blockKeys" class="mt-1.5" :options="options(BLOCK_KEYS_LABEL)" aria-label="Block keys" />
+        </label>
+      </div>
+      <Notice v-if="changed && notes.length" tone="info" :lines="notes" />
+      <Notice v-if="changed && blockedByLock" tone="warning">Unlock the bucket first; this change reads the stored data.</Notice>
+      <div class="flex flex-wrap items-center gap-2">
+        <Button size="sm" :disabled="!changed || blockedByLock || busy" @click="confirming = 'save'">Save changes</Button>
+        <Button v-if="changed" size="sm" variant="outline" :disabled="busy" @click="reset">Discard</Button>
+        <Button
+          v-if="status.mode !== 'off'"
+          class="ml-auto"
+          size="sm"
+          variant="outline"
+          :disabled="!canRotate || busy"
+          @click="confirming = 'rotate'"
+        >
+          Rotate key
+        </Button>
+      </div>
+      <p v-if="status.mode !== 'off' && locked" class="text-[11px] text-muted-foreground">
+        Rotation needs the bucket unlocked.
+      </p>
+      <Notice v-if="failure && !confirming" tone="error">{{ failure }}</Notice>
+    </div>
+
+    <Dialog :open="confirming !== null" @update:open="(open: boolean) => !open && (confirming = null)">
+      <DialogContent class="max-w-md">
+        <DialogHeader>
+          <DialogTitle>{{ confirming === 'rotate' ? 'Rotate the bucket key?' : 'Change the encryption?' }}</DialogTitle>
+          <DialogDescription>
+            {{ confirming === 'rotate' ? 'Open uploads must finish first.' : 'Open uploads must finish first; new writes follow the new setting.' }}
+          </DialogDescription>
+        </DialogHeader>
+        <Notice v-if="confirming === 'rotate' || notes.length" tone="warning" :lines="confirming === 'rotate' ? ROTATION_NOTES : notes" />
+        <Notice v-if="failure" tone="error">{{ failure }}</Notice>
+        <DialogFooter>
+          <Button variant="outline" size="sm" @click="confirming = null">Cancel</Button>
+          <Button size="sm" :disabled="busy" @click="confirm">{{ confirming === 'rotate' ? 'Rotate' : 'Save' }}</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  </section>
+</template>
diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index 8e02bdd9..a7e76ee5 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -41,6 +41,7 @@ const DialogStub = defineComponent({
 const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
   vue: VueRuntime,
   '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
+  '@/components/storage/BucketEncryptionSettings.vue': moduleDefault(defineComponent(() => () => h('section', 'mode settings'))),
   '@/components/storage/BucketHoldersSection.vue': moduleDefault(defineComponent(() => () => h('section', 'holder list'))),
   '@/components/storage/BucketUnlockDialog.vue': moduleDefault(DialogStub),
   '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
@@ -215,6 +216,9 @@ describe('bucket encryption tab', () => {
     expect(text).toContain('No key action is open to you right now.')
     expect(text).not.toContain('Lock now')
     expect(text).not.toContain('holder list')
+    expect(text).not.toContain('mode settings')
     expect(await render('ready', encrypted())).toContain('holder list')
+    const admin = { holder: false, ready_copy: false, admin: true }
+    expect(await render('ready', encrypted({ mode: 'off', caller: admin }))).toContain('mode settings')
   })
 })
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index b6811a29..29468d8b 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -2,6 +2,7 @@
 // The encryption of one bucket as the node that hosts it reports it: mode, lock
 // state, key fingerprint, format, holders, recovery and any rewrite that runs.
 import { computed, ref, toRef } from 'vue'
+import BucketEncryptionSettings from '@/components/storage/BucketEncryptionSettings.vue'
 import BucketHoldersSection from '@/components/storage/BucketHoldersSection.vue'
 import BucketUnlockDialog from '@/components/storage/BucketUnlockDialog.vue'
 import Badge from '@/components/ui/Badge.vue'
@@ -189,6 +190,14 @@ const WARNINGS = [
         :source="encryption"
       />
 
+      <BucketEncryptionSettings
+        v-if="caller?.admin"
+        :status="status"
+        :busy="Boolean(busy)"
+        :save="encryption.save"
+        :rotate="encryption.rotate"
+      />
+
       <Notice v-if="encrypted" tone="warning" :lines="WARNINGS" />
 
       <BucketUnlockDialog
diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index f88b1325..c71a3bc5 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from 'vitest'
 import type { BucketEncryptionResponse, BucketUnlockStatus, EncryptionTransition } from './api'
 import {
+  changeNeedsUnlock,
+  changeNotes,
   compressionSummary,
   holderSummary,
   lockView,
@@ -78,4 +80,18 @@ describe('bucket encryption wording', () => {
     expect(transitionView({ ...visited, cleanup_remaining: 0 })).toMatchObject({ state: 'Finished', complete: true })
     expect(transitionView({ ...TRANSITION, remaining: null }).detail).toContain('an unknown number left')
   })
+
+  it('says which mode changes need an unlock and what they do', () => {
+    const plain = { mode: 'off', cipher: 'chacha20_poly1305', block_keys: 'content_derived' } as BucketEncryptionResponse
+    const managed = { ...plain, mode: 'node_managed' } as BucketEncryptionResponse
+    const draft = { mode: 'vault_locked' as const, cipher: plain.cipher, block_keys: plain.block_keys, max_unlock_ms: null }
+
+    expect(changeNeedsUnlock(plain, draft)).toBe(false)
+    expect(changeNotes(plain, draft).join(' ')).toContain('no unlock is needed')
+    expect(changeNeedsUnlock(managed, draft)).toBe(true)
+    expect(changeNotes(managed, draft).join(' ')).toContain('An old backup of the node still holds the old key.')
+    expect(changeNeedsUnlock(managed, { ...draft, mode: 'node_managed', max_unlock_ms: 5 })).toBe(false)
+    expect(changeNeedsUnlock(managed, { ...draft, mode: 'node_managed', cipher: 'aes256_gcm' })).toBe(true)
+    expect(changeNeedsUnlock(managed, { ...draft, mode: 'off' })).toBe(true)
+  })
 })
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 8c52e71b..174a2bfc 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -204,3 +204,61 @@ export function encryptionError(error: unknown): string {
   const code = error instanceof ApiError ? (error.code ?? '') : ''
   return REFUSALS[code] ?? apiErrorMessage(error)
 }
+
+/** The settings an admin may change with PUT; the key generation is the one shown. */
+export interface EncryptionDraft {
+  mode: EncryptionMode
+  cipher: BlockCipher
+  block_keys: BlockKeys
+  max_unlock_ms: number | null
+}
+
+function formatChanged(from: BucketEncryptionResponse, to: EncryptionDraft): boolean {
+  return from.cipher !== to.cipher || from.block_keys !== to.block_keys
+}
+
+/** Changes that read stored data or the private key need the bucket unlocked first. */
+export function changeNeedsUnlock(from: BucketEncryptionResponse, to: EncryptionDraft): boolean {
+  if (from.mode === 'off') return false
+  return to.mode !== from.mode || formatChanged(from, to)
+}
+
+/** Short notes on what a change does, shown before it is saved. */
+export function changeNotes(from: BucketEncryptionResponse, to: EncryptionDraft): string[] {
+  const notes: string[] = []
+  if (from.mode === 'off' && to.mode !== 'off') {
+    notes.push('Stored versions are encrypted in the background with the public key; no unlock is needed.')
+    notes.push('Old plaintext copies are removed where the storage backend allows it; old backups keep them.')
+  } else if (from.mode !== 'off' && to.mode === 'off') {
+    notes.push('Stored versions are decrypted in the background; the keys stay until every version is rewritten.')
+  } else if (from.mode === 'vault_locked' && to.mode === 'node_managed') {
+    notes.push('The node keeps its own copy of the key and unlocks the bucket at startup.')
+    notes.push('This protects only against the storage provider, not against this node.')
+  } else if (from.mode === 'node_managed' && to.mode === 'vault_locked') {
+    notes.push('A new key is made, stored versions are granted to it, and the node copy is removed.')
+    notes.push('An old backup of the node still holds the old key.')
+  }
+  if (to.mode !== 'off' && from.mode !== 'off' && formatChanged(from, to)) {
+    notes.push('Stored versions are written again in the new format.')
+  }
+  if (to.mode === 'vault_locked') {
+    notes.push('A node restart locks the bucket. Recovery needs a usable recovery code or another ready key holder.')
+  }
+  return notes
+}
+
+export const ROTATION_NOTES = [
+  'A new key is made and every stored version is granted to it; the data itself is not rewritten.',
+  'Rotation does not invalidate an old backup that still holds the old key.',
+]
+
+export function maxUnlockOptions(current: number | null): { value: string; label: string }[] {
+  const options = [
+    { value: '', label: 'No limit: until lock or restart' },
+    ...[HOUR, 8 * HOUR, 24 * HOUR, 7 * 24 * HOUR].map((ms) => ({ value: String(ms), label: formatDuration(ms) })),
+  ]
+  if (current !== null && !options.some((option) => option.value === String(current))) {
+    options.push({ value: String(current), label: formatDuration(current) })
+  }
+  return options
+}

From 09d56a9f64ae394b7cbcb63696008cfb58c451bb Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:23:41 +0200
Subject: [PATCH 12/86] feat: show jobs waiting for a bucket key and restart
 lock notices

---
 src/components/jobs/JobDetailPanel.vue        |  2 +
 .../jobs/JobDistributedDetail.test.ts         | 24 +++++++++++
 src/components/jobs/JobKeyWait.test.ts        | 41 +++++++++++++++++++
 src/components/jobs/JobKeyWait.vue            | 27 ++++++++++++
 src/components/jobs/JobsPanel.vue             |  2 +-
 src/lib/bucketEncryption.ts                   | 10 +++++
 src/lib/jobs.ts                               | 12 ++++++
 src/lib/notifications.test.ts                 | 16 ++++++++
 src/lib/notifications.ts                      | 11 ++++-
 src/lib/stateBadge.ts                         |  1 +
 10 files changed, 144 insertions(+), 2 deletions(-)
 create mode 100644 src/components/jobs/JobKeyWait.test.ts
 create mode 100644 src/components/jobs/JobKeyWait.vue

diff --git a/src/components/jobs/JobDetailPanel.vue b/src/components/jobs/JobDetailPanel.vue
index 72739319..786cde13 100644
--- a/src/components/jobs/JobDetailPanel.vue
+++ b/src/components/jobs/JobDetailPanel.vue
@@ -12,6 +12,7 @@ import CopyButton from '@/components/ui/CopyButton.vue'
 import JobArtifactButton from '@/components/jobs/JobArtifactButton.vue'
 import JobAuditTrail from '@/components/jobs/JobAuditTrail.vue'
 import JobFamilySection from '@/components/jobs/JobFamilySection.vue'
+import JobKeyWait from '@/components/jobs/JobKeyWait.vue'
 import JobReportPanel from '@/components/jobs/JobReportPanel.vue'
 import JobStateBadge from '@/components/jobs/JobStateBadge.vue'
 import { useJobDetail } from '@/composables/useJobs'
@@ -96,6 +97,7 @@ async function confirmCancel() {
       <ErrorPanel v-else-if="loadState === 'error'" :message="loadError || 'This could not be loaded.'" @retry="load" />
 
       <div v-else-if="job" class="space-y-6">
+        <JobKeyWait v-if="job.state === 'awaiting_key'" :waits="job.awaiting_keys ?? []" />
         <section class="space-y-2">
           <h3 class="font-display text-sm font-semibold text-aruna-navy">Progress</h3>
           <Progress
diff --git a/src/components/jobs/JobDistributedDetail.test.ts b/src/components/jobs/JobDistributedDetail.test.ts
index 52ac8c9c..fba09901 100644
--- a/src/components/jobs/JobDistributedDetail.test.ts
+++ b/src/components/jobs/JobDistributedDetail.test.ts
@@ -328,6 +328,7 @@ function jobPanel(job: JobStatusResponse): Component {
     '@/components/jobs/JobFamilySection.vue': moduleDefault(
       defineComponent(() => () => h('section', 'native family detail')),
     ),
+    '@/components/jobs/JobKeyWait.vue': moduleDefault(defineComponent(() => () => h('aside', 'waits for an unlock'))),
     '@/components/jobs/JobReportPanel.vue': moduleDefault(PassThroughStub),
     '@/components/jobs/JobStateBadge.vue': moduleDefault(JobStateBadgeStub),
     '@/composables/useJobs': {
@@ -390,6 +391,29 @@ describe('distributed job detail components', () => {
     { destination_key: 'in/config.yaml', bytes: 2048, source_node_id: null, transfer_ms: 0 },
   ]
 
+  it('tells a job that waits for a bucket key apart from a failed one', async () => {
+    const waiting: JobStatusResponse = {
+      job_id: '01JJRSTVWXYZ0123456789ABCE',
+      kind: 'staging',
+      state: 'awaiting_key',
+      attempts: 0,
+      cancel_requested: false,
+      created_at: '2026-04-09T14:23:11.123+00:00',
+      updated_at: '2026-04-09T14:31:47.902+00:00',
+      progress: { current: 0, unit: 'inputs' },
+      workspace_mode: 'none',
+      awaiting_keys: [{ node_id: 'node-b', bucket: 'reef' }],
+    }
+
+    const mounted = await mount(jobPanel(waiting), { jobId: waiting.job_id, open: true })
+
+    expect(mounted.errors).toEqual([])
+    expect(content(mounted.root)).toContain('waits for an unlock')
+    expect(Jobs.JOB_STATE_META.awaiting_key).toEqual({ label: 'Waiting for a key', variant: 'warn' })
+    expect(Jobs.isTerminalJobState('awaiting_key')).toBe(false)
+    mounted.app.unmount()
+  })
+
   it('states no workspace detail, whatever the node reports', async () => {
     // A node may still serve a mode and a bucket; a run owns neither any more.
     const JobDetailPanel = jobPanel({
diff --git a/src/components/jobs/JobKeyWait.test.ts b/src/components/jobs/JobKeyWait.test.ts
new file mode 100644
index 00000000..1ca187ec
--- /dev/null
+++ b/src/components/jobs/JobKeyWait.test.ts
@@ -0,0 +1,41 @@
+import { defineComponent, h } from 'vue'
+import * as VueRuntime from 'vue'
+import { describe, expect, it } from 'vitest'
+import * as Wording from '@/lib/bucketEncryption'
+import { compileClientComponent, content, element, mountApp, moduleDefault } from '@/test/clientRender'
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+const LinkStub = defineComponent({
+  props: { to: Object },
+  setup: (props, { slots }) => () => h('a', { 'data-to': JSON.stringify(props.to) }, slots.default?.()),
+})
+
+const wait = compileClientComponent(new URL('./JobKeyWait.vue', import.meta.url), {
+  vue: VueRuntime,
+  'vue-router': { RouterLink: LinkStub },
+  '@/components/ui/NodeLabel.vue': moduleDefault(defineComponent({ props: { nodeId: String }, setup: (props) => () => h('span', props.nodeId) })),
+  '@/components/ui/Notice.vue': moduleDefault(Slotted('aside')),
+  '@/lib/bucketEncryption': Wording,
+})
+
+describe('job waiting for a bucket key', () => {
+  it('links every locked bucket to its Encryption tab on its own node', async () => {
+    const { root } = await mountApp(wait, { props: { waits: [{ node_id: 'node-b', bucket: 'reef', group_id: 'g-1' }] } })
+    const link = element(root, (node) => node.tag === 'a')
+
+    expect(content(root)).toContain('neither fails nor')
+    expect(content(root)).toContain('reef on node-b')
+    expect(JSON.parse(String(link.props['data-to']))).toEqual({
+      name: 'bucket-storage',
+      params: { bucketId: 'reef' },
+      query: { tab: 'encryption', node: 'node-b', group: 'g-1' },
+    })
+  })
+
+  it('says so when the node named no bucket', async () => {
+    const { root } = await mountApp(wait, { props: { waits: [] } })
+
+    expect(content(root)).toContain('did not say which bucket')
+  })
+})
diff --git a/src/components/jobs/JobKeyWait.vue b/src/components/jobs/JobKeyWait.vue
new file mode 100644
index 00000000..936788df
--- /dev/null
+++ b/src/components/jobs/JobKeyWait.vue
@@ -0,0 +1,27 @@
+<script setup lang="ts">
+// A job that waits for a locked bucket: not failed and not retried, it goes on
+// once a key holder unlocks every bucket named here on its own node.
+import { RouterLink } from 'vue-router'
+import NodeLabel from '@/components/ui/NodeLabel.vue'
+import Notice from '@/components/ui/Notice.vue'
+import { bucketUnlockLink } from '@/lib/bucketEncryption'
+import type { JobKeyWait } from '@/lib/jobs'
+
+defineProps<{ waits: JobKeyWait[] }>()
+</script>
+
+<template>
+  <Notice tone="warning" title="Waiting for a bucket unlock" data-key-wait>
+    This job needs data from a locked bucket. It goes on once a key holder unlocks it; until then it neither fails nor
+    retries.
+    <ul v-if="waits.length" class="mt-1 list-disc space-y-0.5 pl-4">
+      <li v-for="wait in waits" :key="`${wait.node_id}/${wait.bucket}`">
+        <RouterLink :to="bucketUnlockLink(wait.bucket, wait.node_id, wait.group_id)" class="font-medium underline">
+          {{ wait.bucket }}
+        </RouterLink>
+        on <NodeLabel :node-id="wait.node_id" size="sm" />
+      </li>
+    </ul>
+    <p v-else class="mt-1">The node did not say which bucket it waits for.</p>
+  </Notice>
+</template>
diff --git a/src/components/jobs/JobsPanel.vue b/src/components/jobs/JobsPanel.vue
index d61ea213..19b576f5 100644
--- a/src/components/jobs/JobsPanel.vue
+++ b/src/components/jobs/JobsPanel.vue
@@ -59,7 +59,7 @@ const {
 // Grouped state chips over the loaded list (the tasks-panel treatment).
 type StateGroup = 'all' | 'active' | 'done' | 'failed' | 'cancelled'
 const GROUP_STATES: Record<Exclude<StateGroup, 'all'>, JobState[]> = {
-  active: ['queued', 'claimed', 'preparing', 'ready', 'running', 'cancelling'],
+  active: ['queued', 'awaiting_key', 'claimed', 'preparing', 'ready', 'running', 'cancelling'],
   done: ['succeeded'],
   failed: ['failed', 'indeterminate'],
   cancelled: ['cancelled'],
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 174a2bfc..89213ccc 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -15,6 +15,7 @@ import {
   type HolderState,
   type RecoveryStatus,
 } from './api'
+import type { RouteLocationRaw } from 'vue-router'
 import { formatDuration } from './utils'
 
 export const MODE_LABEL: Record<EncryptionMode, string> = {
@@ -262,3 +263,12 @@ export function maxUnlockOptions(current: number | null): { value: string; label
   }
   return options
 }
+
+/** The Encryption tab of a bucket on the node that hosts it, where a key holder unlocks it. */
+export function bucketUnlockLink(bucket: string, nodeId?: string | null, groupId?: string | null): RouteLocationRaw {
+  return {
+    name: 'bucket-storage',
+    params: { bucketId: bucket },
+    query: { tab: 'encryption', ...(nodeId ? { node: nodeId } : {}), ...(groupId ? { group: groupId } : {}) },
+  }
+}
diff --git a/src/lib/jobs.ts b/src/lib/jobs.ts
index 35fae634..1e3b5ce7 100644
--- a/src/lib/jobs.ts
+++ b/src/lib/jobs.ts
@@ -11,6 +11,7 @@ import { errorMessage } from './utils'
 // JobState::name(): stable machine-readable names, closed set.
 export type JobState =
   | 'queued'
+  | 'awaiting_key'
   | 'claimed'
   | 'preparing'
   | 'ready'
@@ -148,6 +149,8 @@ export interface JobStatusResponse {
   workspace_mode: string
   /** Present for a notebook session: the catalog runtime it runs. */
   session_runtime?: string
+  /** The locked buckets an `awaiting_key` job waits for; omitted in other states. */
+  awaiting_keys?: JobKeyWait[]
   // This node spent its attempts without a job-specific verdict; not a proven
   // failure. Served with a default, so an older node omits it.
   locally_exhausted?: boolean
@@ -156,6 +159,13 @@ export interface JobStatusResponse {
   family?: JobFamilyResponse
 }
 
+/** A locked bucket a job needs; an unlock of it lets the job go on. */
+export interface JobKeyWait {
+  node_id: string
+  bucket: string
+  group_id?: string
+}
+
 export interface JobListResponse {
   jobs: JobStatusResponse[]
   // Opaque base64url cursor; omitted on the last page. Pass back verbatim.
@@ -689,6 +699,7 @@ export function placementVerdict(placement?: PlacementLike | null): PlacementVer
 
 export const JOB_STATE_ORDER: JobState[] = [
   'queued',
+  'awaiting_key',
   'claimed',
   'preparing',
   'ready',
@@ -709,6 +720,7 @@ export function isTerminalJobState(state: JobState): boolean {
 
 const JOB_STATE_LABEL: Record<JobState, string> = {
   queued: 'Queued',
+  awaiting_key: 'Waiting for a key',
   claimed: 'Claimed',
   preparing: 'Preparing',
   ready: 'Ready',
diff --git a/src/lib/notifications.test.ts b/src/lib/notifications.test.ts
index d056ae13..8f8b1f8f 100644
--- a/src/lib/notifications.test.ts
+++ b/src/lib/notifications.test.ts
@@ -2,6 +2,22 @@ import { describe, expect, it } from 'vitest'
 import { describeNotification } from './notifications'
 import type { ApiNotification } from '@/lib/api'
 
+describe('restart lock notifications', () => {
+  it('opens the Encryption tab of the bucket on the node that restarted', () => {
+    const notification: ApiNotification = {
+      id: 'notification-2', category: 'storage.encryption', kind: 'bucket_locked_by_restart',
+      class: 'direct', created_at_ms: 1, read: false, bucket: 'reef', node_id: 'node-b', group_id: 'group-1',
+    }
+    const display = describeNotification(notification, { groupName: () => undefined })
+    expect(display.title).toBe('A node restart locked reef')
+    expect(display.link).toEqual({
+      name: 'bucket-storage',
+      params: { bucketId: 'reef' },
+      query: { tab: 'encryption', node: 'node-b', group: 'group-1' },
+    })
+  })
+})
+
 describe('join request notifications', () => {
   it('names the group and opens its Members tab', () => {
     const notification: ApiNotification = {
diff --git a/src/lib/notifications.ts b/src/lib/notifications.ts
index 4e67b678..eb268a75 100644
--- a/src/lib/notifications.ts
+++ b/src/lib/notifications.ts
@@ -1,7 +1,8 @@
 import type { Component } from 'vue'
 import type { RouteLocationRaw } from 'vue-router'
-import { AlertTriangle, ArrowLeftRight, Bell, FileJson2, HardDrive, Upload, UserMinus, UserPlus, Users } from '@lucide/vue'
+import { AlertTriangle, ArrowLeftRight, Bell, FileJson2, HardDrive, Lock, Upload, UserMinus, UserPlus, Users } from '@lucide/vue'
 import type { ApiNotification } from '@/lib/api'
+import { bucketUnlockLink } from '@/lib/bucketEncryption'
 import { formatBytes, truncateMiddle } from '@/lib/utils'
 
 // Lookup helpers the caller can provide so titles use display names the portal
@@ -103,6 +104,14 @@ export const NOTIFICATION_KINDS: Record<string, NotificationKindDescriptor> = {
         ? { name: 'bucket', params: { bucketId: n.bucket }, query: n.node_id ? { node: n.node_id } : {} }
         : null,
   },
+  // Encryption stage 4: sent to each key holder when a node restart locked a
+  // vault-locked bucket that was unlocked before; opens its Encryption tab.
+  bucket_locked_by_restart: {
+    icon: Lock,
+    title: (n) => (n.bucket ? `A node restart locked ${n.bucket}` : 'A node restart locked a bucket'),
+    detail: () => 'A key holder must unlock it again before its data can be read.',
+    link: (n) => (n.bucket ? bucketUnlockLink(n.bucket, n.node_id, n.group_id) : null),
+  },
   sync_failed: {
     icon: AlertTriangle,
     title: (n) => (n.bucket ? `Bucket sync failed for ${n.bucket}` : 'Bucket sync failed'),
diff --git a/src/lib/stateBadge.ts b/src/lib/stateBadge.ts
index d752e185..88fd10a9 100644
--- a/src/lib/stateBadge.ts
+++ b/src/lib/stateBadge.ts
@@ -60,6 +60,7 @@ const STATE_TONE: Record<string, StateTone> = {
   preempted: 'attention',
   // System job states.
   claimed: 'progress',
+  awaiting_key: 'attention',
   preparing: 'progress',
   ready: 'info',
   cancelling: 'attention',

From 85c4064b1746fecd8226243a71d58ed7ad251124 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:26:25 +0200
Subject: [PATCH 13/86] test: unlock a vault-locked bucket through the whole
 browser flow

---
 .../useBucketEncryption.flow.test.ts          | 167 ++++++++++++++++++
 1 file changed, 167 insertions(+)
 create mode 100644 src/composables/useBucketEncryption.flow.test.ts

diff --git a/src/composables/useBucketEncryption.flow.test.ts b/src/composables/useBucketEncryption.flow.test.ts
new file mode 100644
index 00000000..c9112a4b
--- /dev/null
+++ b/src/composables/useBucketEncryption.flow.test.ts
@@ -0,0 +1,167 @@
+// The whole browser unlock against fake nodes: the real vault, copy opening,
+// unlock flow and bucket state, with the shared vectors as the node's data.
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ref } from 'vue'
+import copy from '@/lib/vault/__fixtures__/bucket-copy.json'
+import { createVault, sealKeypair } from '@/lib/vault/crypto'
+
+vi.mock('./s3/endpoints', () => ({
+  localNodeId: () => 'node-a',
+  nodeApiBase: (id: string) => (id === copy.node_id ? 'https://b.test/api/v1' : 'https://a.test/api/v1'),
+}))
+
+const KEY_ID = copy.key_id
+const PASSPHRASE = 'correct horse battery'
+
+function bytes(hex: string): Uint8Array<ArrayBuffer> {
+  return Uint8Array.from(hex.match(/../g) ?? [], (pair) => parseInt(pair, 16))
+}
+
+function base64(hex: string): string {
+  return btoa(String.fromCharCode(...bytes(hex)))
+}
+
+/** A vault whose only keypair is the vector user key, retired as after a rotation elsewhere. */
+async function retiredVault(): Promise<string> {
+  const created = await createVault(PASSPHRASE, false, { iterations: 500 })
+  const entry = await sealKeypair(created.masterKey, KEY_ID, bytes(copy.recipient_private), '2026-10-01T00:00:00Z')
+  return JSON.stringify({ ...created.payload, keys: [{ ...entry, retired_at: '2026-10-02T00:00:00Z' }] })
+}
+
+interface NodeCall {
+  method: string
+  url: URL
+  key?: string
+}
+
+async function fakeNodes() {
+  const calls: NodeCall[] = []
+  const stored: string[] = []
+  const directory = [{ record_id: 'R1', key_id: KEY_ID, public_key: base64(copy.recipient_public), fingerprint: '', has_recovery: true, created_at: '' }]
+  let heads = [{ revision: 'R0001', predecessors: [], payload: await retiredVault(), updated_at: '' }]
+  let unlocked = false
+  const status = () => ({
+    bucket: 'reef',
+    mode: 'vault_locked',
+    bucket_id: copy.bucket_id,
+    storage_generation: 1,
+    key_generation: copy.generation,
+    public_key: base64(copy.bucket_public),
+    fingerprint: copy.bucket_fingerprint,
+    cipher: 'chacha20_poly1305',
+    block_keys: 'content_derived',
+    max_unlock_ms: null,
+    unlock: unlocked
+      ? { state: 'unlocked', lock_reason: null, locked_at_ms: null, session_id: 'S1', unlocked_at_ms: 2, deadline_ms: 3_600_002, max_deadline_ms: null }
+      : { state: 'locked', lock_reason: 'restart', locked_at_ms: 1, session_id: null, unlocked_at_ms: null, deadline_ms: null, max_deadline_ms: null },
+    holders: { ready: 1, pending: 0, missing_key: 0 },
+    recovery: { state: 'met', ready_holders: 1, ready_with_recovery: 1 },
+    transition: null,
+    caller: { holder: true, ready_copy: true, admin: false },
+  })
+  const sealedCopy = {
+    bucket_id: copy.bucket_id,
+    generation: copy.generation,
+    key_record: copy.key_record,
+    key_id: KEY_ID,
+    enc: base64(copy.enc),
+    ciphertext: base64(copy.ciphertext),
+    created_at_ms: 1,
+  }
+  vi.stubGlobal('window', { location: { origin: 'https://portal.test' } })
+  vi.stubGlobal('localStorage', { getItem: () => null, setItem: (_: string, value: string) => stored.push(value) })
+  vi.stubGlobal('fetch', vi.fn(async (input: URL, init: RequestInit) => {
+    const url = new URL(String(input))
+    const method = init.method ?? 'GET'
+    const body = init.body instanceof Uint8Array ? Array.from(init.body, (b) => b.toString(16).padStart(2, '0')).join('') : undefined
+    calls.push({ method, url, key: body })
+    const path = url.pathname.replace('/api/v1', '')
+    const json = (value: unknown) => new Response(JSON.stringify(value))
+    if (path === '/access/users/me/vault' && method === 'GET') return json({ heads })
+    if (path === '/access/users/me/vault' && method === 'PUT') {
+      const request = JSON.parse(String(init.body))
+      heads = [{ revision: 'R0002', predecessors: request.predecessors, payload: request.payload, updated_at: '' }]
+      return json({ heads })
+    }
+    if (path.startsWith('/access/users/') && path.endsWith('/keys') && method === 'GET') return json({ keys: directory })
+    if (path === '/access/users/me/keys') {
+      const request = JSON.parse(String(init.body))
+      directory.unshift({ ...request, record_id: 'R2', fingerprint: '', created_at: '' })
+      return json(directory[0])
+    }
+    if (path.endsWith('/storage/encryption')) return json(status())
+    if (path.endsWith('/storage/compression')) return json({ bucket: 'reef', mode: 'off' })
+    if (path.endsWith('/copies/me')) return json({ copies: [sealedCopy] })
+    if (path.endsWith('/unlock')) {
+      unlocked = true
+      return json(status().unlock)
+    }
+    return new Response('{}', { status: 404 })
+  }))
+  return { calls, stored }
+}
+
+async function signIn() {
+  vi.resetModules()
+  const state = await import('./aruna/state')
+  state.apiBaseUrl.value = 'https://a.test/api/v1'
+  state.authToken.value = 'bearer-1'
+  state.userInfo.value = { user: { user_id: copy.user_id }, realm: { realm_id: copy.realm_id } } as never
+  const { useUserVault } = await import('./useUserVault')
+  const { useBucketEncryption } = await import('./useBucketEncryption')
+  return { state, vault: useUserVault(), useBucketEncryption }
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('unlocking a vault-locked bucket from the browser', () => {
+  it('opens the copy with a retired vault key and sends only that bucket key to its node', async () => {
+    const { calls, stored } = await fakeNodes()
+    const { vault: keys, useBucketEncryption } = await signIn()
+    await keys.load()
+    await keys.unlock(PASSPHRASE)
+    const encryption = useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1'))
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+
+    const outcome = await encryption.unlock(3_600_000)
+
+    expect(outcome).toMatchObject({ kind: 'unlocked', ownKey: 'matches' })
+    expect(encryption.status.value?.unlock?.state).toBe('unlocked')
+    const unlock = calls.find((call) => call.url.pathname.endsWith('/unlock'))!
+    expect(unlock.url.origin).toBe('https://b.test')
+    expect(unlock.key).toBe(copy.bucket_private)
+    expect(Object.fromEntries(unlock.url.searchParams)).toEqual({
+      bucket_id: copy.bucket_id,
+      generation: String(copy.generation),
+      duration_ms: '3600000',
+    })
+    // The new vault key was published before the copy was fetched.
+    const published = calls.findIndex((call) => call.url.pathname.endsWith('/users/me/keys'))
+    const fetched = calls.findIndex((call) => call.url.pathname.endsWith('/copies/me'))
+    expect(published).toBeGreaterThanOrEqual(0)
+    expect(published).toBeLessThan(fetched)
+    // Nothing the browser stored holds the bucket key in any encoding.
+    for (const value of stored) {
+      expect(value).not.toContain(copy.bucket_private)
+      expect(value).not.toContain(base64(copy.bucket_private))
+    }
+  })
+
+  it('sends nothing for a bucket shown under another session', async () => {
+    const { calls } = await fakeNodes()
+    const { state, vault: keys, useBucketEncryption } = await signIn()
+    await keys.load()
+    await keys.unlock(PASSPHRASE)
+    const encryption = useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1'))
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+
+    const pending = encryption.unlock()
+    state.sessionEpoch.value += 1
+    const outcome = await pending.catch((error: unknown) => error)
+
+    expect(outcome === null || outcome instanceof Error).toBe(true)
+    expect(calls.some((call) => call.url.pathname.endsWith('/unlock'))).toBe(false)
+  })
+})

From 5c3f66644ca79a7fc31168d3d6630e3b9bb30182 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:26:26 +0200
Subject: [PATCH 14/86] feat: document encrypted buckets

---
 .../storage/BucketEncryptionTab.test.ts       |  1 +
 .../storage/BucketEncryptionTab.vue           |  2 +
 src/docs/v1.ts                                | 64 +++++++++++++++++++
 src/views/DocsView.test.ts                    |  1 +
 4 files changed, 68 insertions(+)

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index a7e76ee5..92b38034 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -47,6 +47,7 @@ const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.m
   '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
   '@/components/ui/Button.vue': moduleDefault(ButtonStub),
   '@/components/ui/DetailList.vue': moduleDefault(DetailStub),
+  '@/components/ui/DocsLink.vue': moduleDefault(Slotted('a')),
   '@/components/ui/NodeLabel.vue': moduleDefault(Slotted('span')),
   '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
   '@/components/ui/RefreshButton.vue': moduleDefault(Slotted('button')),
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index 29468d8b..d9c7c241 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -8,6 +8,7 @@ import BucketUnlockDialog from '@/components/storage/BucketUnlockDialog.vue'
 import Badge from '@/components/ui/Badge.vue'
 import Button from '@/components/ui/Button.vue'
 import DetailList, { type Detail } from '@/components/ui/DetailList.vue'
+import DocsLink from '@/components/ui/DocsLink.vue'
 import NodeLabel from '@/components/ui/NodeLabel.vue'
 import Notice from '@/components/ui/Notice.vue'
 import RefreshButton from '@/components/ui/RefreshButton.vue'
@@ -118,6 +119,7 @@ const WARNINGS = [
         <header class="flex flex-wrap items-center gap-2 border-b border-border px-5 py-4">
           <KeyRound class="size-4 text-primary" />
           <h2 class="font-display text-sm font-semibold text-aruna-navy">Encryption</h2>
+          <DocsLink icon topic="encrypted-buckets" />
           <Badge v-if="lock" :variant="stateVariant(lock.label)" data-lock-state>{{ lock.label }}</Badge>
           <span class="ml-auto inline-flex items-center gap-2 text-[11px] text-muted-foreground">
             <template v-if="encryption.nodeId.value">
diff --git a/src/docs/v1.ts b/src/docs/v1.ts
index b68ae39b..77abfad3 100644
--- a/src/docs/v1.ts
+++ b/src/docs/v1.ts
@@ -794,6 +794,70 @@ export const docsTopics: DocsTopic[] = [
       },
     ],
   },
+  {
+    slug: 'encrypted-buckets',
+    kind: 'Guide',
+    title: 'Encrypt a bucket',
+    summary: 'Keep the stored data of a bucket readable only while a key holder unlocks it.',
+    sections: [
+      {
+        title: 'Encryption modes',
+        icon: 'Shield',
+        bullets: [
+          'Off: the node stores the bytes as they are, or compressed when the bucket compresses.',
+          'Node-managed: the node keeps its own copy of the bucket key and unlocks the bucket at startup. This protects against the storage provider only, not against the node.',
+          'Vault-locked: only key holders unlock the bucket, and a node restart locks it again.',
+        ],
+        paragraphs: [
+          'Writes, listing and HEAD work while a bucket is locked. Downloads, previews and jobs that need its content wait for an unlock. The content hash stays visible in metadata, so equal files are still recognisable.',
+          'S3 clients see an encrypted bucket like SSE-S3 (`x-amz-server-side-encryption: AES256`) and send no key.',
+        ],
+      },
+      {
+        title: 'Key holders and recovery',
+        icon: 'Users',
+        paragraphs: [
+          'Key holders are the bucket creator, the group admins and users granted explicitly. Each one has a copy of the bucket key, sealed to the key in their vault. A user who loses group-admin rights loses the right to unlock at once.',
+          'A vault-locked bucket needs a recovery code or two ready key holders. Removing a key holder that breaks this rule needs a confirmation, and removing a key holder does not erase copies they already made.',
+          'Your vault passphrase needs at least 12 characters, because the vault opens bucket keys. Set it up under [Settings](page:settings), Provider keys.',
+        ],
+      },
+      {
+        title: 'Unlock, extend and lock',
+        icon: 'KeyRound',
+        steps: [
+          'Open the settings of the bucket and switch to the Encryption tab.',
+          'Choose Unlock. Your vault opens in this browser; enter its passphrase when it is locked.',
+          'Pick how long the unlock lasts, within the bucket maximum.',
+          'The browser opens your copy of the bucket key and sends only the bucket key to the node that hosts the bucket.',
+          'Extend a timed unlock, or choose Lock now when you are done.',
+        ],
+        paragraphs: [
+          'An unlock lets every reader with access on that node read the bucket until it locks. When the node does not confirm an unlock, the portal reads the bucket state first and never sends the key again on its own.',
+          'Jobs that need a locked bucket show Waiting for a key. They neither fail nor retry, and they go on after an unlock.',
+        ],
+      },
+      {
+        title: 'Change the mode or rotate the key',
+        icon: 'RefreshCw',
+        paragraphs: [
+          'Group admins change the mode, the cipher, the block keys and the longest unlock on the same tab. Open uploads must finish first.',
+          'Turning encryption on needs no unlock: stored versions are encrypted in the background. Turning it off, changing the format, switching between modes and rotating the key need the bucket unlocked.',
+          'The tab shows the progress of the rewrite. It is complete only after the old copies are removed.',
+          'Rotation grants every stored version to a new key without rewriting the data. It does not invalidate an old backup that still holds the old key.',
+        ],
+      },
+      {
+        title: 'Limits',
+        icon: 'ShieldCheck',
+        bullets: [
+          'Deletion is not secure erasure: old backups and copies a backend keeps still hold their bytes.',
+          'Logs, reports and outputs that user code writes are not rewritten.',
+          'This browser remembers your vault key. On Aruna Desktop the browser and the node share one disk, so that disk can open your bucket keys.',
+        ],
+      },
+    ],
+  },
   {
     slug: 'invenio-zenodo',
     kind: 'Guide',
diff --git a/src/views/DocsView.test.ts b/src/views/DocsView.test.ts
index 4484b952..e6845598 100644
--- a/src/views/DocsView.test.ts
+++ b/src/views/DocsView.test.ts
@@ -67,6 +67,7 @@ describe('versioned in-portal Docs', () => {
       'notebooks',
       'storage-backend',
       'cli-access-key',
+      'encrypted-buckets',
       'invenio-zenodo',
       'dataset-git',
       'assistant',

From f383222aa0a8307ae6a02b929f4907a510441375 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:26:55 +0200
Subject: [PATCH 15/86] chore: keep encryption comments within three lines

---
 src/lib/api/bucketEncryption.ts | 6 ++----
 src/lib/notifications.ts        | 4 ++--
 src/lib/vault/bucketCopy.ts     | 6 ++----
 src/lib/vault/bucketUnlock.ts   | 6 ++----
 4 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index e6941ea9..0b2a46d7 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -31,10 +31,8 @@ export interface HolderReadiness {
   missing_key: number | null
 }
 
-/**
- * `met`: two ready holders, or one whose directory record declares a recovery code.
- * `unknown`: the key directory did not answer, so the rule could not be checked.
- */
+// `met`: two ready holders, or one whose directory record declares a recovery code.
+// `unknown`: the key directory did not answer, so the rule could not be checked.
 export interface RecoveryStatus {
   state: 'met' | 'degraded' | 'unknown'
   ready_holders: number | null
diff --git a/src/lib/notifications.ts b/src/lib/notifications.ts
index eb268a75..8f369d72 100644
--- a/src/lib/notifications.ts
+++ b/src/lib/notifications.ts
@@ -104,8 +104,8 @@ export const NOTIFICATION_KINDS: Record<string, NotificationKindDescriptor> = {
         ? { name: 'bucket', params: { bucketId: n.bucket }, query: n.node_id ? { node: n.node_id } : {} }
         : null,
   },
-  // Encryption stage 4: sent to each key holder when a node restart locked a
-  // vault-locked bucket that was unlocked before; opens its Encryption tab.
+  // Sent to each key holder when a node restart locked a vault-locked bucket
+  // that was unlocked before; opens its Encryption tab on that node.
   bucket_locked_by_restart: {
     icon: Lock,
     title: (n) => (n.bucket ? `A node restart locked ${n.bucket}` : 'A node restart locked a bucket'),
diff --git a/src/lib/vault/bucketCopy.ts b/src/lib/vault/bucketCopy.ts
index 2af1cf9c..8670409d 100644
--- a/src/lib/vault/bucketCopy.ts
+++ b/src/lib/vault/bucketCopy.ts
@@ -110,10 +110,8 @@ function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
   return a.length === b.length && a.every((byte, index) => byte === b[index])
 }
 
-/**
- * Opens a copy and checks that the key in it belongs to `bucketPublic`. The
- * caller owns the returned raw key and must clear it.
- */
+// Opens a copy and checks that the key in it belongs to `bucketPublic`. The
+// caller owns the returned raw key and must clear it.
 export async function openBucketCopy(
   recipient: X25519Pair,
   sealed: SealedSecret,
diff --git a/src/lib/vault/bucketUnlock.ts b/src/lib/vault/bucketUnlock.ts
index 0f69e1c7..fd102dcb 100644
--- a/src/lib/vault/bucketUnlock.ts
+++ b/src/lib/vault/bucketUnlock.ts
@@ -87,10 +87,8 @@ async function openFirst(
   )
 }
 
-/**
- * `current` must stay true for the account, session, realm, API base, node, group,
- * bucket id, key generation and request that started the unlock.
- */
+// `current` must stay true for the account, session, realm, API base, node, group,
+// bucket id, key generation and request that started the unlock.
 export async function unlockWithVault(
   target: UnlockTarget,
   vault: UnlockVault,

From 3a0328714d2194f3d23653d3e11457308787e96e Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:28:31 +0200
Subject: [PATCH 16/86] fix: name bucket unlock lengths in whole units

---
 .../storage/BucketUnlockDialog.test.ts        |  2 +-
 src/lib/bucketEncryption.test.ts              |  8 +++++
 src/lib/bucketEncryption.ts                   | 32 +++++++++++--------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/src/components/storage/BucketUnlockDialog.test.ts b/src/components/storage/BucketUnlockDialog.test.ts
index efef013a..c7740312 100644
--- a/src/components/storage/BucketUnlockDialog.test.ts
+++ b/src/components/storage/BucketUnlockDialog.test.ts
@@ -71,7 +71,7 @@ describe('bucket unlock dialog', () => {
     const root = await render(8 * 3_600_000)
     const select = element(root, (node) => node.tag === 'select')
 
-    expect(content(select)).toBe('The bucket maximum (8h 00m)15 minutes1 hour')
+    expect(content(select)).toBe('The bucket maximum (8 hours)15 minutes1 hour')
     ;(select.props['onUpdate:modelValue'] as (value: string) => void)('3600000')
     await flush()
     await click(button(root, 'Unlock'))
diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index c71a3bc5..d3b88b47 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -8,6 +8,7 @@ import {
   lockView,
   modeLabel,
   recoverySummary,
+  spanLabel,
   transitionView,
 } from './bucketEncryption'
 import { stateTone } from './stateBadge'
@@ -94,4 +95,11 @@ describe('bucket encryption wording', () => {
     expect(changeNeedsUnlock(managed, { ...draft, mode: 'node_managed', cipher: 'aes256_gcm' })).toBe(true)
     expect(changeNeedsUnlock(managed, { ...draft, mode: 'off' })).toBe(true)
   })
+
+  it('names unlock lengths in whole units', () => {
+    expect(spanLabel(15 * 60_000)).toBe('15 minutes')
+    expect(spanLabel(3_600_000)).toBe('1 hour')
+    expect(spanLabel(7 * 86_400_000)).toBe('7 days')
+    expect(spanLabel(90_500)).toBe('1m 31s')
+  })
 })
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 89213ccc..fb946f36 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -129,8 +129,20 @@ export function compressionSummary(
     : `${requested}, applied as level ${compression.effective_level} in Pithos`
 }
 
+const MINUTE = 60_000
+const HOUR = 60 * MINUTE
+const DAY = 24 * HOUR
+
+/** "15 minutes", "8 hours", "7 days"; an uneven length keeps the compact form. */
+export function spanLabel(ms: number): string {
+  for (const [size, unit] of [[DAY, 'day'], [HOUR, 'hour'], [MINUTE, 'minute']] as const) {
+    if (ms >= size && ms % size === 0) return `${ms / size} ${unit}${ms === size ? '' : 's'}`
+  }
+  return formatDuration(ms)
+}
+
 export function maxUnlockLabel(ms: number | null): string {
-  return ms === null ? 'Until lock or restart' : formatDuration(ms)
+  return ms === null ? 'Until lock or restart' : spanLabel(ms)
 }
 
 const KIND_LABEL: Record<EncryptionTransition['kind'], string> = {
@@ -173,19 +185,13 @@ export function transitionView(transition: EncryptionTransition): TransitionView
   }
 }
 
-const HOUR = 3_600_000
-const DURATIONS: [number, string][] = [
-  [HOUR / 4, '15 minutes'],
-  [HOUR, '1 hour'],
-  [8 * HOUR, '8 hours'],
-  [24 * HOUR, '24 hours'],
-]
+const DURATIONS = [15 * MINUTE, HOUR, 8 * HOUR, DAY]
 
 /** Unlock lengths within the bucket maximum; '' leaves it to the node: the maximum, or until lock. */
 export function durationOptions(maxMs: number | null): { value: string; label: string }[] {
-  const fallback = maxMs === null ? 'Until lock or restart' : `The bucket maximum (${formatDuration(maxMs)})`
-  const shorter = DURATIONS.filter(([ms]) => maxMs === null || ms < maxMs)
-  return [{ value: '', label: fallback }, ...shorter.map(([ms, label]) => ({ value: String(ms), label }))]
+  const fallback = maxMs === null ? 'Until lock or restart' : `The bucket maximum (${spanLabel(maxMs)})`
+  const shorter = DURATIONS.filter((ms) => maxMs === null || ms < maxMs)
+  return [{ value: '', label: fallback }, ...shorter.map((ms) => ({ value: String(ms), label: spanLabel(ms) }))]
 }
 
 const REFUSALS: Record<string, string> = {
@@ -256,10 +262,10 @@ export const ROTATION_NOTES = [
 export function maxUnlockOptions(current: number | null): { value: string; label: string }[] {
   const options = [
     { value: '', label: 'No limit: until lock or restart' },
-    ...[HOUR, 8 * HOUR, 24 * HOUR, 7 * 24 * HOUR].map((ms) => ({ value: String(ms), label: formatDuration(ms) })),
+    ...[HOUR, 8 * HOUR, DAY, 7 * DAY].map((ms) => ({ value: String(ms), label: spanLabel(ms) })),
   ]
   if (current !== null && !options.some((option) => option.value === String(current))) {
-    options.push({ value: String(current), label: formatDuration(current) })
+    options.push({ value: String(current), label: spanLabel(current) })
   }
   return options
 }

From aa168c11c59ecaf3327a63d5bce19a967981d6e8 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:28:54 +0200
Subject: [PATCH 17/86] fix: say that a node-managed bucket unlocks again after
 a restart

---
 src/lib/bucketEncryption.test.ts | 1 +
 src/lib/bucketEncryption.ts      | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index d3b88b47..45da4f6d 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -46,6 +46,7 @@ describe('bucket encryption wording', () => {
     expect(lockView(bucket(LOCKED)).label).toBe('Locked')
     expect(lockView(bucket({ ...LOCKED, lock_reason: 'restart' })).label).toBe('Locked since restart')
     expect(lockView(bucket({ ...LOCKED, state: 'unlocked', lock_reason: null })).label).toBe('Unlocked')
+    expect(lockView(bucket({ ...LOCKED, state: 'unlocked' }, 'node_managed')).detail).toContain('again after a restart')
     expect(lockView(bucket({ ...LOCKED, state: 'unlocked', deadline_ms: 5_000 })).label).toBe('Timed unlock')
     expect(lockView(bucket(null)).label).toBe('Unknown')
     expect(lockView(bucket(null, 'off')).label).toBe('Not encrypted')
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index fb946f36..ec3e47b4 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -75,7 +75,13 @@ export function lockView(status: BucketEncryptionResponse): LockView {
   if (unlock.state === 'unlocked') {
     return unlock.deadline_ms !== null
       ? { label: 'Timed unlock', detail: `Locks itself at ${at(unlock.deadline_ms)}.` }
-      : { label: 'Unlocked', detail: 'Until a key holder locks it or the node restarts.' }
+      : {
+          label: 'Unlocked',
+          detail:
+            status.mode === 'node_managed'
+              ? 'The node holds its own key copy and unlocks the bucket again after a restart.'
+              : 'Until a key holder locks it or the node restarts.',
+        }
   }
   if (unlock.lock_reason === 'restart') {
     return { label: 'Locked since restart', detail: 'The node restarted. A key holder must unlock it again.' }

From 95f93ab30d239b89c8b0bff521577fee8c3891b3 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:47:11 +0200
Subject: [PATCH 18/86] chore: drop the banners of the bucket encryption
 requests

---
 src/lib/api/bucketCompression.ts | 6 +++---
 src/lib/api/bucketEncryption.ts  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/lib/api/bucketCompression.ts b/src/lib/api/bucketCompression.ts
index fe4d67e0..3455932a 100644
--- a/src/lib/api/bucketCompression.ts
+++ b/src/lib/api/bucketCompression.ts
@@ -1,6 +1,6 @@
-// ── Bucket compression (GET /data/buckets/{bucket}/storage/compression) ────
-// Node-local, asked of the bucket's own node. An encrypted bucket compresses
-// inside Pithos at the nearest supported level, which `effective_level` names.
+// The compression setting of a bucket, asked of the bucket's own node. An
+// encrypted bucket compresses inside Pithos at the nearest supported level,
+// which `effective_level` names.
 import { apiRequest, type ApiClientOptions } from './client'
 
 export interface BucketCompressionResponse {
diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index 0b2a46d7..fdaeeacf 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -1,6 +1,6 @@
-// ── Bucket encryption (/data/buckets/{bucket}/storage/encryption) ──────────
-// Node-local: every request goes to the API base of the node hosting the bucket,
-// never through S3. An older node answers 404: "not reported here", never "off".
+// Bucket encryption routes. Every request goes to the API base of the node that
+// hosts the bucket, never through S3. An older node answers 404: "not reported
+// here", never "off".
 import { ApiError, apiRequest, type ApiClientOptions } from './client'
 
 export type EncryptionMode = 'off' | 'node_managed' | 'vault_locked'

From e37d1fe7bd46ce95cd4d02ce1987667ee36a5395 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:48:32 +0200
Subject: [PATCH 19/86] fix: clear the secrets HPKE derives once they are used

---
 src/lib/vault/hpke.test.ts | 40 ++++++++++++++++++-
 src/lib/vault/hpke.ts      | 78 +++++++++++++++++++++++++++++---------
 2 files changed, 99 insertions(+), 19 deletions(-)

diff --git a/src/lib/vault/hpke.test.ts b/src/lib/vault/hpke.test.ts
index 6dff4d10..18ba2c2b 100644
--- a/src/lib/vault/hpke.test.ts
+++ b/src/lib/vault/hpke.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import vectors from './__fixtures__/vault.json'
 import { SealOpenError, deriveKeyPair, importPrivateKey, openSealed, sealTo } from './hpke'
 
@@ -14,6 +14,31 @@ const vector = vectors.hpke
 const info = hex(vector.info)
 const aad = hex(vector.aad)
 
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+/** Records the raw HMAC and AES keys, the signed inputs and the X25519 results WebCrypto sees. */
+function recordSecrets() {
+  const seen: Uint8Array[] = []
+  const subtle = crypto.subtle as unknown as Record<string, (...args: unknown[]) => Promise<unknown>>
+  const wrap = (name: string, pick: (args: unknown[], result: unknown) => Uint8Array | null) => {
+    const original = subtle[name].bind(crypto.subtle)
+    vi.spyOn(subtle, name).mockImplementation(async (...args: unknown[]) => {
+      const result = await original(...args)
+      const secret = pick(args, result)
+      if (secret) seen.push(secret)
+      return result
+    })
+  }
+  const algorithm = (value: unknown) => (typeof value === 'string' ? value : (value as { name: string }).name)
+  wrap('importKey', (args) =>
+    args[0] === 'raw' && ['HMAC', 'AES-GCM'].includes(algorithm(args[2])) ? (args[1] as Uint8Array) : null)
+  wrap('sign', (args) => args[2] as Uint8Array)
+  wrap('deriveBits', (_args, result) => new Uint8Array(result as ArrayBuffer))
+  return seen
+}
+
 describe('hpke', () => {
   it('derives the vector ephemeral key from its input', async () => {
     const ephemeral = await deriveKeyPair(hex(vector.ephemeral_ikm))
@@ -53,4 +78,17 @@ describe('hpke', () => {
     tampered.ciphertext[0] ^= 1
     await expect(openSealed(recipient, tampered, encoder.encode('purpose a'), encoder.encode('object a'))).rejects.toThrow(SealOpenError)
   })
+
+  it('clears every secret it derives once a seal or an open is done', async () => {
+    const recipient = await importPrivateKey(hex(vector.recipient_private))
+    const ephemeral = await importPrivateKey(hex(vector.ephemeral_private))
+    const seen = recordSecrets()
+
+    await sealTo(recipient.publicKey, info, aad, hex(vector.plaintext), ephemeral)
+    const plain = await openSealed(recipient, { enc: hex(vector.enc), ciphertext: hex(vector.ciphertext) }, info, aad)
+
+    expect(toHex(plain)).toBe(vector.plaintext)
+    expect(seen.length).toBeGreaterThan(10)
+    expect(seen.filter((secret) => secret.some((byte) => byte !== 0))).toEqual([])
+  })
 })
diff --git a/src/lib/vault/hpke.ts b/src/lib/vault/hpke.ts
index 3badebf4..25b92a9c 100644
--- a/src/lib/vault/hpke.ts
+++ b/src/lib/vault/hpke.ts
@@ -57,8 +57,14 @@ async function hmac(key: Uint8Array<ArrayBuffer>, data: Uint8Array<ArrayBuffer>)
   return new Uint8Array(await crypto.subtle.sign('HMAC', handle, data))
 }
 
-function labeledExtract(suite: Uint8Array, salt: Uint8Array<ArrayBuffer>, label: string, ikm: Uint8Array) {
-  return hmac(salt, concat(VERSION_LABEL, suite, ENCODER.encode(label), ikm))
+/** The input holds the key material, so it is cleared once signed. */
+async function labeledExtract(suite: Uint8Array, salt: Uint8Array<ArrayBuffer>, label: string, ikm: Uint8Array) {
+  const input = concat(VERSION_LABEL, suite, ENCODER.encode(label), ikm)
+  try {
+    return await hmac(salt, input)
+  } finally {
+    input.fill(0)
+  }
 }
 
 async function labeledExpand(
@@ -71,12 +77,22 @@ async function labeledExpand(
   const labeled = concat(Uint8Array.of(length >> 8, length & 255), VERSION_LABEL, suite, ENCODER.encode(label), info)
   let block = new Uint8Array(0)
   const out = new Uint8Array(length)
-  for (let at = 0, counter = 1; at < length; counter += 1) {
-    block = await hmac(prk, concat(block, labeled, Uint8Array.of(counter)))
-    out.set(block.subarray(0, length - at), at)
-    at += block.length
+  try {
+    for (let at = 0, counter = 1; at < length; counter += 1) {
+      const input = concat(block, labeled, Uint8Array.of(counter))
+      block.fill(0)
+      try {
+        block = await hmac(prk, input)
+      } finally {
+        input.fill(0)
+      }
+      out.set(block.subarray(0, length - at), at)
+      at += block.length
+    }
+    return out
+  } finally {
+    block.fill(0)
   }
-  return out
 }
 
 /** Imports a raw X25519 private key and computes its public key. */
@@ -95,14 +111,24 @@ export async function importPrivateKey(raw: Uint8Array): Promise<X25519Pair> {
 /** DeriveKeyPair of RFC 9180, which the test vectors use for the ephemeral key. */
 export async function deriveKeyPair(ikm: Uint8Array): Promise<Uint8Array<ArrayBuffer>> {
   const prk = await labeledExtract(KEM_SUITE, new Uint8Array(0), 'dkp_prk', ikm)
-  return labeledExpand(KEM_SUITE, prk, 'sk', new Uint8Array(0), KEY_BYTES)
+  try {
+    return await labeledExpand(KEM_SUITE, prk, 'sk', new Uint8Array(0), KEY_BYTES)
+  } finally {
+    prk.fill(0)
+  }
 }
 
 async function sharedSecret(privateKey: CryptoKey, peer: Uint8Array<ArrayBuffer>, context: Uint8Array) {
   const peerKey = await crypto.subtle.importKey('raw', peer, X25519, false, [])
   const dh = new Uint8Array(await crypto.subtle.deriveBits({ name: 'X25519', public: peerKey }, privateKey, 256))
-  const prk = await labeledExtract(KEM_SUITE, new Uint8Array(0), 'eae_prk', dh)
-  return labeledExpand(KEM_SUITE, prk, 'shared_secret', context, HASH_BYTES)
+  let prk: Uint8Array<ArrayBuffer> | null = null
+  try {
+    prk = await labeledExtract(KEM_SUITE, new Uint8Array(0), 'eae_prk', dh)
+    return await labeledExpand(KEM_SUITE, prk, 'shared_secret', context, HASH_BYTES)
+  } finally {
+    dh.fill(0)
+    prk?.fill(0)
+  }
 }
 
 async function keySchedule(shared: Uint8Array<ArrayBuffer>, info: Uint8Array) {
@@ -111,10 +137,19 @@ async function keySchedule(shared: Uint8Array<ArrayBuffer>, info: Uint8Array) {
   const infoHash = await labeledExtract(HPKE_SUITE, empty, 'info_hash', info)
   const context = concat(Uint8Array.of(0), pskIdHash, infoHash)
   const secret = await labeledExtract(HPKE_SUITE, shared, 'secret', empty)
-  const raw = await labeledExpand(HPKE_SUITE, secret, 'key', context, KEY_BYTES)
-  const key = await crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['encrypt', 'decrypt'])
-  const nonce = await labeledExpand(HPKE_SUITE, secret, 'base_nonce', context, NONCE_BYTES)
-  return { key, nonce }
+  try {
+    const raw = await labeledExpand(HPKE_SUITE, secret, 'key', context, KEY_BYTES)
+    let key: CryptoKey
+    try {
+      key = await crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['encrypt', 'decrypt'])
+    } finally {
+      raw.fill(0)
+    }
+    const nonce = await labeledExpand(HPKE_SUITE, secret, 'base_nonce', context, NONCE_BYTES)
+    return { key, nonce }
+  } finally {
+    secret.fill(0)
+  }
 }
 
 async function ephemeralPair(): Promise<X25519Pair> {
@@ -133,9 +168,13 @@ export async function sealTo(
 ): Promise<SealedSecret> {
   const { privateKey, publicKey: enc } = ephemeral ?? await ephemeralPair()
   const shared = await sharedSecret(privateKey, recipient, concat(enc, recipient))
-  const { key, nonce } = await keySchedule(shared, info)
-  const sealed = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, plain)
-  return { enc, ciphertext: new Uint8Array(sealed) }
+  try {
+    const { key, nonce } = await keySchedule(shared, info)
+    const sealed = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, plain)
+    return { enc, ciphertext: new Uint8Array(sealed) }
+  } finally {
+    shared.fill(0)
+  }
 }
 
 /** Opens a sealed secret with the recipient's keypair. */
@@ -145,13 +184,16 @@ export async function openSealed(
   info: Uint8Array,
   aad: Uint8Array<ArrayBuffer>,
 ): Promise<Uint8Array<ArrayBuffer>> {
+  let shared: Uint8Array<ArrayBuffer> | null = null
   try {
     const context = concat(sealed.enc, recipient.publicKey)
-    const shared = await sharedSecret(recipient.privateKey, sealed.enc, context)
+    shared = await sharedSecret(recipient.privateKey, sealed.enc, context)
     const { key, nonce } = await keySchedule(shared, info)
     const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, sealed.ciphertext)
     return new Uint8Array(plain)
   } catch {
     throw new SealOpenError()
+  } finally {
+    shared?.fill(0)
   }
 }

From 00faadaf0d7b91d9e7dd843ff23e1e06939c5cb6 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:50:09 +0200
Subject: [PATCH 20/86] fix: keep a bucket request dead after its context
 changed or ended

---
 .../useBucketEncryption.flow.test.ts          | 10 ++--
 src/composables/useBucketEncryption.test.ts   | 52 +++++++++++++++++--
 src/composables/useBucketEncryption.ts        | 21 ++++++--
 3 files changed, 71 insertions(+), 12 deletions(-)

diff --git a/src/composables/useBucketEncryption.flow.test.ts b/src/composables/useBucketEncryption.flow.test.ts
index c9112a4b..a64d3587 100644
--- a/src/composables/useBucketEncryption.flow.test.ts
+++ b/src/composables/useBucketEncryption.flow.test.ts
@@ -1,7 +1,7 @@
 // The whole browser unlock against fake nodes: the real vault, copy opening,
 // unlock flow and bucket state, with the shared vectors as the node's data.
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { ref } from 'vue'
+import { effectScope, ref } from 'vue'
 import copy from '@/lib/vault/__fixtures__/bucket-copy.json'
 import { createVault, sealKeypair } from '@/lib/vault/crypto'
 
@@ -112,7 +112,11 @@ async function signIn() {
   return { state, vault: useUserVault(), useBucketEncryption }
 }
 
+let scope = effectScope()
+
 afterEach(() => {
+  scope.stop()
+  scope = effectScope()
   vi.unstubAllGlobals()
 })
 
@@ -122,7 +126,7 @@ describe('unlocking a vault-locked bucket from the browser', () => {
     const { vault: keys, useBucketEncryption } = await signIn()
     await keys.load()
     await keys.unlock(PASSPHRASE)
-    const encryption = useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1'))
+    const encryption = scope.run(() => useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1')))!
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
 
     const outcome = await encryption.unlock(3_600_000)
@@ -154,7 +158,7 @@ describe('unlocking a vault-locked bucket from the browser', () => {
     const { state, vault: keys, useBucketEncryption } = await signIn()
     await keys.load()
     await keys.unlock(PASSPHRASE)
-    const encryption = useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1'))
+    const encryption = scope.run(() => useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1')))!
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
 
     const pending = encryption.unlock()
diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
index 89a0422a..1bf3cfb3 100644
--- a/src/composables/useBucketEncryption.test.ts
+++ b/src/composables/useBucketEncryption.test.ts
@@ -1,5 +1,5 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { ref } from 'vue'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { effectScope, ref, type EffectScope } from 'vue'
 import * as Api from '@/lib/api'
 import { authToken, sessionEpoch, userInfo } from './aruna/state'
 import { useBucketEncryption } from './useBucketEncryption'
@@ -53,13 +53,21 @@ function deferred<T>() {
   return { promise, resolve, reject }
 }
 
+const scopes: EffectScope[] = []
+
 function setup(node: string | null = 'node-b') {
   const bucket = ref('reef')
   const nodeId = ref<string | null>(node)
-  const encryption = useBucketEncryption(bucket, nodeId, ref('g-1'))
-  return { encryption, bucket, nodeId }
+  const scope = effectScope()
+  scopes.push(scope)
+  const encryption = scope.run(() => useBucketEncryption(bucket, nodeId, ref('g-1')))!
+  return { encryption, bucket, nodeId, scope }
 }
 
+afterEach(() => {
+  for (const scope of scopes.splice(0)) scope.stop()
+})
+
 beforeEach(() => {
   getBucketEncryption.mockReset().mockResolvedValue(status())
   getBucketCompression.mockReset().mockResolvedValue({ bucket: 'reef', mode: 'zstd', level: 3, effective_level: 4 })
@@ -160,6 +168,42 @@ describe('bucket encryption state', () => {
     expect(live()).toBe(false)
   })
 
+  it('keeps an unlock dead after the page left the bucket and came back', async () => {
+    const { encryption, bucket } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    const pending = deferred<unknown>()
+    unlockWithVault.mockReturnValue(pending.promise)
+
+    const answer = encryption.unlock()
+    await vi.waitFor(() => expect(unlockWithVault).toHaveBeenCalled())
+    const live = unlockWithVault.mock.calls[0][2] as () => boolean
+    bucket.value = 'other'
+    bucket.value = 'reef'
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    pending.resolve({ kind: 'unlocked', status: {}, ownKey: 'matches' })
+
+    expect(live()).toBe(false)
+    expect(await answer).toBeNull()
+  })
+
+  it('drops the answer and the failure of a request whose state was disposed', async () => {
+    const { encryption, scope } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    const pending = deferred<unknown>()
+    unlockWithVault.mockReturnValue(pending.promise)
+    const loadsBefore = getBucketEncryption.mock.calls.length
+
+    const answer = encryption.unlock()
+    await vi.waitFor(() => expect(unlockWithVault).toHaveBeenCalled())
+    const live = unlockWithVault.mock.calls[0][2] as () => boolean
+    scope.stop()
+    pending.reject(new Api.ApiError(400, 'refused', 'wrong_key'))
+
+    expect(live()).toBe(false)
+    expect(await answer).toBeNull()
+    expect(getBucketEncryption.mock.calls.length).toBe(loadsBefore)
+  })
+
   it('stops the unlock when the bucket key changes under it', async () => {
     const { encryption } = setup()
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index 5efbb49a..51f3109e 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -1,7 +1,7 @@
 // Encryption state of one bucket, asked of the node that hosts it. An answer is
 // kept only while the account, session, realm, node API base, group and bucket
 // it was asked for are still current; anything else is dropped unseen.
-import { computed, ref, watch, type Ref } from 'vue'
+import { computed, onScopeDispose, ref, watch, type Ref } from 'vue'
 import {
   ApiError,
   apiErrorMessage,
@@ -35,6 +35,9 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
   const busy = ref<EncryptionAction | null>(null)
   /** An unlock whose answer never came; only a successful status read clears it. */
   const outcomeUnknown = ref(false)
+  // Grows on every context change and on disposal and never goes back, so a
+  // request from bucket A stays dead when the page returns to bucket A.
+  let generation = 0
   let loads = 0
 
   const scope = computed(() => {
@@ -55,10 +58,10 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     return { baseUrl: scope.value.apiBase, token: authToken.value }
   }
 
-  /** A check that stays true while the scope a request started in is current. */
+  /** A check that stays true until the context changes or the state is disposed. */
   function binder(): () => boolean {
-    const key = scopeKey.value
-    return () => scopeKey.value === key
+    const captured = generation
+    return () => captured === generation
   }
 
   function failed(cause: unknown): EncryptionLoadState {
@@ -104,6 +107,10 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     try {
       const result = await work(bound)
       return bound() ? result : null
+    } catch (cause) {
+      // A failure of a request from an older context is as stale as its success.
+      if (!bound()) return null
+      throw cause
     } finally {
       // The status is read again before any outcome is shown, also after a failure.
       if (bound()) {
@@ -163,6 +170,7 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
   watch(
     scopeKey,
     () => {
+      generation += 1
       status.value = null
       compression.value = null
       error.value = null
@@ -172,8 +180,11 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
       state.value = 'loading'
       void load()
     },
-    { immediate: true },
+    { immediate: true, flush: 'sync' },
   )
+  onScopeDispose(() => {
+    generation += 1
+  })
 
   return {
     status,

From 9d8e154a7421a986e2d38400aab41253da85504e Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:50:29 +0200
Subject: [PATCH 21/86] fix: treat any server error after an unlock as an
 unknown outcome

---
 src/lib/vault/bucketUnlock.test.ts | 9 +++++++++
 src/lib/vault/bucketUnlock.ts      | 4 ++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/lib/vault/bucketUnlock.test.ts b/src/lib/vault/bucketUnlock.test.ts
index f64cf1c9..0e70ec4d 100644
--- a/src/lib/vault/bucketUnlock.test.ts
+++ b/src/lib/vault/bucketUnlock.test.ts
@@ -130,6 +130,15 @@ describe('bucket unlock from the browser', () => {
     expect(sent[1].body?.every((byte) => byte === 0)).toBe(true)
   })
 
+  it('treats any server error as an unknown outcome', async () => {
+    for (const status of [500, 503]) {
+      const sent = node([COPY], () => new Response(JSON.stringify({ error: 'down' }), { status }))
+
+      expect(await unlockWithVault(TARGET, vault(), always)).toEqual({ kind: 'unknown', ownKey: 'matches' })
+      expect(sent.filter((call) => call.method === 'POST')).toHaveLength(1)
+    }
+  })
+
   it('passes on a refusal from the node and still clears the key', async () => {
     const sent = node([COPY], () => new Response(JSON.stringify({ error: 'no', code: 'wrong_key' }), { status: 400 }))
 
diff --git a/src/lib/vault/bucketUnlock.ts b/src/lib/vault/bucketUnlock.ts
index fd102dcb..cd05b529 100644
--- a/src/lib/vault/bucketUnlock.ts
+++ b/src/lib/vault/bucketUnlock.ts
@@ -109,8 +109,8 @@ export async function unlockWithVault(
     const status = await unlockBucket(target.bucket, request, key, target.client)
     return { kind: 'unlocked', status, ownKey }
   } catch (cause) {
-    // A gateway error or a lost answer does not say whether the node applied the key.
-    const answered = cause instanceof ApiError && cause.status !== 502 && cause.status !== 504
+    // Only a 4xx says the key was not applied; a 5xx or a lost answer says nothing.
+    const answered = cause instanceof ApiError && cause.status < 500
     if (answered || cause instanceof UnlockStaleError) throw cause
     return { kind: 'unknown', ownKey }
   } finally {

From bd6a8c08cb6a69b59eb0ca8feb7308f1b6cd81e0 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:50:42 +0200
Subject: [PATCH 22/86] fix: call a rewrite finished only without failed or
 remaining versions

---
 src/lib/bucketEncryption.test.ts | 4 ++++
 src/lib/bucketEncryption.ts      | 8 +++++---
 src/lib/stateBadge.ts            | 1 +
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index 45da4f6d..43d46f49 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -80,6 +80,10 @@ describe('bucket encryption wording', () => {
     expect(transitionView(visited)).toMatchObject({ state: 'Cleanup open', complete: false })
     expect(transitionView({ ...visited, cleanup_remaining: null }).complete).toBe(false)
     expect(transitionView({ ...visited, cleanup_remaining: 0 })).toMatchObject({ state: 'Finished', complete: true })
+    expect(transitionView({ ...visited, cleanup_remaining: 0, failed: 2 })).toMatchObject({
+      state: 'Some versions failed',
+      complete: false,
+    })
     expect(transitionView({ ...TRANSITION, remaining: null }).detail).toContain('an unknown number left')
   })
 
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index ec3e47b4..ebab975c 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -181,11 +181,13 @@ export function transitionView(transition: EncryptionTransition): TransitionView
       ? 'old copies still to count'
       : `${transition.cleanup_remaining} old ${transition.cleanup_remaining === 1 ? 'copy' : 'copies'} to remove`
   const failed = transition.failed ? `, ${transition.failed} failed` : ''
-  const complete =
-    transition.state === 'finished' && transition.remaining === 0 && transition.cleanup_remaining === 0
+  const settled = transition.remaining === 0 && transition.failed === 0 && transition.cleanup_remaining === 0
+  const complete = transition.state === 'finished' && settled
+  // A node that says finished with work left is not believed.
+  const unsettled = transition.failed ? 'Some versions failed' : 'Cleanup open'
   return {
     title: known(KIND_LABEL, transition.kind),
-    state: complete ? 'Finished' : transition.state === 'finished' ? 'Cleanup open' : known(STATE_LABEL, transition.state),
+    state: complete ? 'Finished' : transition.state === 'finished' ? unsettled : known(STATE_LABEL, transition.state),
     detail: `${transition.done} done, ${remaining} left${failed}, ${cleanup}.`,
     complete,
   }
diff --git a/src/lib/stateBadge.ts b/src/lib/stateBadge.ts
index 88fd10a9..ffd40cf8 100644
--- a/src/lib/stateBadge.ts
+++ b/src/lib/stateBadge.ts
@@ -106,6 +106,7 @@ const STATE_TONE: Record<string, StateTone> = {
   'not met': 'attention',
   finished: 'done',
   'cleanup open': 'progress',
+  'some versions failed': 'attention',
   'removing old copies': 'progress',
   'waiting for an unlock': 'attention',
   blocked: 'attention',

From 35e7d87e79c8480ff42723badcc8e92bff698669 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:54:56 +0200
Subject: [PATCH 23/86] fix: describe a bucket by every key generation it still
 needs

---
 src/lib/api/bucketEncryption.ts  | 17 ++++++++++-
 src/lib/bucketEncryption.test.ts | 18 +++++++++++-
 src/lib/bucketEncryption.ts      | 50 +++++++++++++++++++++++++++-----
 src/lib/stateBadge.ts            |  2 ++
 4 files changed, 78 insertions(+), 9 deletions(-)

diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index fdaeeacf..26bffa75 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -71,6 +71,19 @@ export interface EncryptionCaller {
   admin: boolean
 }
 
+export type KeyRole = 'active' | 'source'
+
+/** A key generation the node still needs: the active one, or the source of a running change. */
+export interface BucketKeyGeneration {
+  generation: number
+  role: KeyRole
+  /** Standard base64 of the 32-byte X25519 public key. */
+  public_key: string
+  /** Lowercase hex SHA-256 of the public key. */
+  fingerprint: string
+  unlock: BucketUnlockStatus
+}
+
 export interface BucketEncryptionResponse {
   bucket: string
   mode: EncryptionMode
@@ -87,8 +100,10 @@ export interface BucketEncryptionResponse {
   block_keys: BlockKeys
   /** Longest unlock a holder may ask for; null means until lock or restart. */
   max_unlock_ms: number | null
-  /** Null while encryption is off. */
+  /** The active generation's unlock state; null while encryption is off. */
   unlock: BucketUnlockStatus | null
+  /** Every generation the node still needs, also while mode is off; absent on an older node. */
+  generations?: BucketKeyGeneration[]
   holders: HolderReadiness | null
   recovery: RecoveryStatus | null
   transition: EncryptionTransition | null
diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index 43d46f49..8d060194 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import type { BucketEncryptionResponse, BucketUnlockStatus, EncryptionTransition } from './api'
 import {
+  keyGenerations,
   changeNeedsUnlock,
   changeNotes,
   compressionSummary,
@@ -49,7 +50,8 @@ describe('bucket encryption wording', () => {
     expect(lockView(bucket({ ...LOCKED, state: 'unlocked' }, 'node_managed')).detail).toContain('again after a restart')
     expect(lockView(bucket({ ...LOCKED, state: 'unlocked', deadline_ms: 5_000 })).label).toBe('Timed unlock')
     expect(lockView(bucket(null)).label).toBe('Unknown')
-    expect(lockView(bucket(null, 'off')).label).toBe('Not encrypted')
+    expect(lockView({ ...bucket(null, 'off'), generations: [] }).label).toBe('Not encrypted')
+    expect(lockView(bucket(null, 'off')).label).toBe('Not encrypted for new writes')
     expect(stateTone('Locked since restart')).toBe('attention')
   })
 
@@ -107,4 +109,18 @@ describe('bucket encryption wording', () => {
     expect(spanLabel(7 * 86_400_000)).toBe('7 days')
     expect(spanLabel(90_500)).toBe('1m 31s')
   })
+
+  it('keeps a bucket with an encrypted source generation from reading as plain', () => {
+    const source = { generation: 3, role: 'source' as const, public_key: 'PK3', fingerprint: 'f3', unlock: LOCKED }
+    const off = { ...bucket(null, 'off'), generations: [source] }
+
+    expect(lockView(off)).toMatchObject({ label: 'Decrypting' })
+    expect(lockView(off).detail).toContain('reading them needs an unlock')
+    expect(keyGenerations(off)).toEqual({ list: [source], reported: true })
+    const older = { ...bucket(LOCKED), key_generation: 4, public_key: 'PK4', fingerprint: 'f4' }
+    expect(keyGenerations(older)).toEqual({
+      list: [{ generation: 4, role: 'active', public_key: 'PK4', fingerprint: 'f4', unlock: LOCKED }],
+      reported: false,
+    })
+  })
 })
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index ebab975c..a01cc49f 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -8,6 +8,8 @@ import {
   type BlockKeys,
   type BucketCompressionResponse,
   type BucketEncryptionResponse,
+  type BucketKeyGeneration,
+  type BucketUnlockStatus,
   type EncryptionMode,
   type EncryptionTransition,
   type HolderOrigin,
@@ -67,20 +69,54 @@ function at(ms: number): string {
   return new Date(ms).toLocaleString()
 }
 
+export const ROLE_LABEL: Record<BucketKeyGeneration['role'], string> = {
+  active: 'Active key',
+  source: 'Previous key',
+}
+
+export interface KeyGenerations {
+  list: BucketKeyGeneration[]
+  /** False for a node that did not list its generations: only the active key is known. */
+  reported: boolean
+}
+
+export function keyGenerations(status: BucketEncryptionResponse): KeyGenerations {
+  if (status.generations) return { list: status.generations, reported: true }
+  const { public_key: publicKey, fingerprint, unlock } = status
+  if (status.mode === 'off' || !publicKey || !fingerprint || !unlock) return { list: [], reported: false }
+  const active = { generation: status.key_generation, role: 'active' as const, public_key: publicKey, fingerprint, unlock }
+  return { list: [active], reported: false }
+}
+
 /** Locked, unlocked, timed unlock or locked since restart; unknown when the node gave no lock state. */
 export function lockView(status: BucketEncryptionResponse): LockView {
-  if (status.mode === 'off') return { label: 'Not encrypted', detail: 'Stored bytes are readable without a key.' }
-  const unlock = status.unlock
-  if (!unlock) return { label: UNKNOWN, detail: 'The node did not report whether the bucket is unlocked.' }
+  if (status.mode === 'off') {
+    const { list, reported } = keyGenerations(status)
+    if (list.length) {
+      return {
+        label: 'Decrypting',
+        detail: 'New writes are not encrypted. Older versions stay encrypted until the rewrite ends, and reading them needs an unlock.',
+      }
+    }
+    if (!reported) {
+      return { label: 'Not encrypted for new writes', detail: 'The node did not say whether older versions are still encrypted.' }
+    }
+    return { label: 'Not encrypted', detail: 'Stored bytes are readable without a key.' }
+  }
+  if (!status.unlock) return { label: UNKNOWN, detail: 'The node did not report whether the bucket is unlocked.' }
+  return unlockView(status.unlock, status.mode === 'node_managed')
+}
+
+/** The lock state of one key generation. */
+export function unlockView(unlock: BucketUnlockStatus, nodeManaged: boolean): LockView {
   if (unlock.state === 'unlocked') {
     return unlock.deadline_ms !== null
       ? { label: 'Timed unlock', detail: `Locks itself at ${at(unlock.deadline_ms)}.` }
       : {
           label: 'Unlocked',
-          detail:
-            status.mode === 'node_managed'
-              ? 'The node holds its own key copy and unlocks the bucket again after a restart.'
-              : 'Until a key holder locks it or the node restarts.',
+          detail: nodeManaged
+            ? 'The node holds its own key copy and unlocks the bucket again after a restart.'
+            : 'Until a key holder locks it or the node restarts.',
         }
   }
   if (unlock.lock_reason === 'restart') {
diff --git a/src/lib/stateBadge.ts b/src/lib/stateBadge.ts
index ffd40cf8..a66b1b6b 100644
--- a/src/lib/stateBadge.ts
+++ b/src/lib/stateBadge.ts
@@ -98,6 +98,8 @@ const STATE_TONE: Record<string, StateTone> = {
   reachable: 'done',
   // Bucket encryption.
   'not encrypted': 'idle',
+  'not encrypted for new writes': 'count',
+  decrypting: 'progress',
   locked: 'idle',
   unlocked: 'done',
   'timed unlock': 'progress',

From fe43ed2f818bb04313234786a7a62bcf23d36082 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:55:12 +0200
Subject: [PATCH 24/86] fix: unlock and extend every key generation a bucket
 still needs

---
 .../storage/BucketEncryptionTab.test.ts       |  80 +++---------
 .../storage/BucketEncryptionTab.vue           |  83 +++---------
 src/components/storage/BucketKeyAccess.vue    | 123 ++++++++++++++++++
 .../storage/BucketUnlockDialog.test.ts        |  13 +-
 src/components/storage/BucketUnlockDialog.vue |  12 +-
 .../useBucketEncryption.flow.test.ts          |   4 +-
 src/composables/useBucketEncryption.test.ts   |  35 +++--
 src/composables/useBucketEncryption.ts        |  25 ++--
 8 files changed, 221 insertions(+), 154 deletions(-)
 create mode 100644 src/components/storage/BucketKeyAccess.vue

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index 92b38034..87c299e8 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -1,20 +1,16 @@
 import { defineComponent, h, ref } from 'vue'
 import * as VueRuntime from 'vue'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import * as Api from '@/lib/api'
+import { beforeEach, describe, expect, it } from 'vitest'
 import type { BucketCompressionResponse, BucketEncryptionResponse } from '@/lib/api'
 import * as Wording from '@/lib/bucketEncryption'
 import * as StateBadge from '@/lib/stateBadge'
 import type { EncryptionLoadState } from '@/composables/useBucketEncryption'
-import { button, click, compileClientComponent, content, mountApp, moduleDefault } from '@/test/clientRender'
+import { compileClientComponent, content, mountApp, moduleDefault } from '@/test/clientRender'
 
 const status = ref<BucketEncryptionResponse | null>(null)
 const compression = ref<BucketCompressionResponse | null>(null)
 const state = ref<EncryptionLoadState>('loading')
 const outcomeUnknown = ref(false)
-const lock = vi.fn()
-const extend = vi.fn()
-const unlock = vi.fn()
 
 const Slotted = (tag: string) =>
   defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
@@ -29,13 +25,9 @@ const DetailStub = defineComponent({
     h('dl', (props.items as { label: string; value: string }[]).map((item) => h('p', `${item.label}: ${item.value}`))),
 })
 
-const ButtonStub = defineComponent({
-  inheritAttrs: false,
-  setup: (_, { attrs, slots }) => () => h('button', attrs, slots.default?.()),
-})
-const DialogStub = defineComponent({
-  props: { open: Boolean },
-  setup: (props) => () => h('div', props.open ? 'unlock dialog open' : ''),
+const KeyAccessStub = defineComponent({
+  props: { status: Object },
+  setup: (props) => () => h('section', `key access for ${(props.status as BucketEncryptionResponse).bucket}`),
 })
 
 const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
@@ -43,15 +35,13 @@ const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.m
   '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
   '@/components/storage/BucketEncryptionSettings.vue': moduleDefault(defineComponent(() => () => h('section', 'mode settings'))),
   '@/components/storage/BucketHoldersSection.vue': moduleDefault(defineComponent(() => () => h('section', 'holder list'))),
-  '@/components/storage/BucketUnlockDialog.vue': moduleDefault(DialogStub),
+  '@/components/storage/BucketKeyAccess.vue': moduleDefault(KeyAccessStub),
   '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
-  '@/components/ui/Button.vue': moduleDefault(ButtonStub),
   '@/components/ui/DetailList.vue': moduleDefault(DetailStub),
   '@/components/ui/DocsLink.vue': moduleDefault(Slotted('a')),
   '@/components/ui/NodeLabel.vue': moduleDefault(Slotted('span')),
   '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
   '@/components/ui/RefreshButton.vue': moduleDefault(Slotted('button')),
-  '@/components/ui/Select.vue': moduleDefault(Slotted('select')),
   '@/components/ui/SectionSkeleton.vue': moduleDefault(defineComponent(() => () => h('section', 'loading placeholder'))),
   '@/composables/useBucketEncryption': {
     useBucketEncryption: () => ({
@@ -64,9 +54,6 @@ const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.m
       outcomeUnknown,
       nodeId: ref('node-b'),
       load: () => undefined,
-      lock,
-      extend,
-      unlock,
     }),
   },
   '@/lib/bucketEncryption': Wording,
@@ -114,19 +101,8 @@ async function render(next: EncryptionLoadState, value: BucketEncryptionResponse
   return content(await mount(next, value))
 }
 
-const OPEN = {
-  state: 'unlocked' as const,
-  lock_reason: null,
-  locked_at_ms: null,
-  session_id: 'S1',
-  unlocked_at_ms: 1,
-  deadline_ms: 9_000,
-  max_deadline_ms: null,
-}
-
 beforeEach(() => {
   outcomeUnknown.value = false
-  lock.mockReset().mockResolvedValue(null)
 })
 
 describe('bucket encryption tab', () => {
@@ -173,49 +149,33 @@ describe('bucket encryption tab', () => {
   })
 
   it('shows a plain bucket without key details', async () => {
-    const text = await render('ready', encrypted({ mode: 'off', unlock: null, public_key: null, fingerprint: null }))
+    const plain = { mode: 'off' as const, unlock: null, public_key: null, fingerprint: null, generations: [] }
+    const text = await render('ready', encrypted(plain))
 
     expect(text).toContain('Mode: Off')
     expect(text).toContain('Not encrypted')
+    expect(text).not.toContain('key access')
     expect(text).not.toContain('Key fingerprint')
     expect(text).toContain('Compression: zstd level 3')
     expect(text).not.toContain('applied as level')
   })
 
-  it('offers a ready key holder the unlock dialog for a locked bucket', async () => {
-    const root = await mount('ready', encrypted())
-
-    expect(content(root)).not.toContain('Lock now')
-    await click(button(root, 'Unlock'))
-    expect(content(root)).toContain('unlock dialog open')
-  })
-
-  it('offers extend and lock while unlocked and words a refusal', async () => {
-    lock.mockRejectedValueOnce(new Api.ApiError(409, 'conflict', 'session_mismatch'))
-    const root = await mount('ready', encrypted({ unlock: OPEN }))
-
-    expect(content(root)).toContain('Timed unlock')
-    expect(content(root)).toContain('Extend')
-    await click(button(root, 'Lock now'))
-
-    expect(lock).toHaveBeenCalledOnce()
-    expect(content(root)).toContain('locked or unlocked again meanwhile')
-  })
-
-  it('holds back a second unlock while the last one is unconfirmed', async () => {
-    outcomeUnknown.value = true
-    const root = await mount('ready', encrypted())
+  it('keeps the previous key of a decrypting bucket within reach', async () => {
+    const source = { generation: 1, role: 'source' as const, public_key: 'PK1', fingerprint: 'f1', unlock: encrypted().unlock! }
+    const off = { mode: 'off' as const, unlock: null, public_key: null, fingerprint: null, generations: [source] }
+    const text = await render('ready', encrypted(off))
 
-    expect(content(root)).toContain('The last unlock was not confirmed')
-    expect(button(root, 'Unlock').props.disabled).toBe(true)
+    expect(text).toContain('Decrypting')
+    expect(text).toContain('reading them needs an unlock')
+    expect(text).not.toContain('readable without a key')
+    expect(text).toContain('key access for reef')
+    expect(text).toContain('holder list')
   })
 
-  it('offers a reader no key action', async () => {
+  it('offers a reader neither holders nor settings', async () => {
     const reader = { holder: false, ready_copy: false, admin: false }
-    const text = await render('ready', encrypted({ unlock: OPEN, caller: reader }))
+    const text = await render('ready', encrypted({ caller: reader }))
 
-    expect(text).toContain('No key action is open to you right now.')
-    expect(text).not.toContain('Lock now')
     expect(text).not.toContain('holder list')
     expect(text).not.toContain('mode settings')
     expect(await render('ready', encrypted())).toContain('holder list')
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index d9c7c241..1d3703df 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -1,27 +1,24 @@
 <script setup lang="ts">
 // The encryption of one bucket as the node that hosts it reports it: mode, lock
 // state, key fingerprint, format, holders, recovery and any rewrite that runs.
-import { computed, ref, toRef } from 'vue'
+import { computed, toRef } from 'vue'
 import BucketEncryptionSettings from '@/components/storage/BucketEncryptionSettings.vue'
 import BucketHoldersSection from '@/components/storage/BucketHoldersSection.vue'
-import BucketUnlockDialog from '@/components/storage/BucketUnlockDialog.vue'
+import BucketKeyAccess from '@/components/storage/BucketKeyAccess.vue'
 import Badge from '@/components/ui/Badge.vue'
-import Button from '@/components/ui/Button.vue'
 import DetailList, { type Detail } from '@/components/ui/DetailList.vue'
 import DocsLink from '@/components/ui/DocsLink.vue'
 import NodeLabel from '@/components/ui/NodeLabel.vue'
 import Notice from '@/components/ui/Notice.vue'
 import RefreshButton from '@/components/ui/RefreshButton.vue'
 import SectionSkeleton from '@/components/ui/SectionSkeleton.vue'
-import Select from '@/components/ui/Select.vue'
 import { useBucketEncryption } from '@/composables/useBucketEncryption'
 import {
   blockKeysLabel,
   cipherLabel,
   compressionSummary,
-  durationOptions,
-  encryptionError,
   holderSummary,
+  keyGenerations,
   lockView,
   maxUnlockLabel,
   modeLabel,
@@ -70,26 +67,8 @@ const permitted = computed(() => {
   return lines
 })
 
-const unlockOpen = ref(false)
-const extendBy = ref('')
-const actionError = ref<string | null>(null)
-const unlocked = computed(() => status.value?.unlock?.state === 'unlocked')
 const caller = computed(() => status.value?.caller)
-const canUnlock = computed(
-  () => encrypted.value && status.value?.unlock?.state === 'locked' && Boolean(caller.value?.holder && caller.value.ready_copy),
-)
-const canExtend = computed(() => unlocked.value && Boolean(caller.value?.holder && status.value?.unlock?.session_id))
-const canLock = computed(() => unlocked.value && Boolean(caller.value?.holder || caller.value?.admin))
-const extendOptions = computed(() => durationOptions(status.value?.max_unlock_ms ?? null))
-
-async function act(work: () => Promise<unknown>) {
-  actionError.value = null
-  try {
-    await work()
-  } catch (cause) {
-    actionError.value = encryptionError(cause)
-  }
-}
+const keyCount = computed(() => (status.value ? keyGenerations(status.value).list.length : 0))
 
 const WARNINGS = [
   'An unlock lets every reader with access on this node read the bucket until it locks.',
@@ -151,42 +130,19 @@ const WARNINGS = [
         </div>
       </section>
 
-      <section v-if="encrypted" class="surface" data-key-access>
-        <header class="flex items-center gap-2 border-b border-border px-5 py-4">
-          <h2 class="font-display text-sm font-semibold text-aruna-navy">Key access</h2>
-        </header>
-        <div class="space-y-3 px-5 py-4">
-          <Notice v-if="outcomeUnknown" tone="warning" title="The last unlock was not confirmed">
-            Read the state again before you try once more; the key is never sent twice on its own.
-          </Notice>
-          <div class="flex flex-wrap items-center gap-2">
-            <Button v-if="canUnlock" size="sm" :disabled="Boolean(busy) || outcomeUnknown" @click="unlockOpen = true">
-              Unlock
-            </Button>
-            <template v-if="canExtend">
-              <Select v-model="extendBy" class="w-56" :options="extendOptions" aria-label="Extend the unlock by" />
-              <Button
-                size="sm"
-                variant="outline"
-                :disabled="Boolean(busy)"
-                @click="act(() => encryption.extend(extendBy ? Number(extendBy) : undefined))"
-              >
-                Extend
-              </Button>
-            </template>
-            <Button v-if="canLock" size="sm" variant="outline" :disabled="Boolean(busy)" @click="act(encryption.lock)">
-              Lock now
-            </Button>
-            <span v-if="!canUnlock && !canExtend && !canLock" class="text-xs text-muted-foreground">
-              No key action is open to you right now.
-            </span>
-          </div>
-          <Notice v-if="actionError" tone="error">{{ actionError }}</Notice>
-        </div>
-      </section>
+      <BucketKeyAccess
+        v-if="keyCount"
+        :bucket="bucket"
+        :status="status"
+        :busy="Boolean(busy)"
+        :outcome-unknown="outcomeUnknown"
+        :unlock="encryption.unlock"
+        :extend="encryption.extend"
+        :lock="encryption.lock"
+      />
 
       <BucketHoldersSection
-        v-if="encrypted && (caller?.holder || caller?.admin)"
+        v-if="(encrypted || keyCount) && (caller?.holder || caller?.admin)"
         :bucket="bucket"
         :can-manage="Boolean(caller?.admin)"
         :source="encryption"
@@ -200,14 +156,7 @@ const WARNINGS = [
         :rotate="encryption.rotate"
       />
 
-      <Notice v-if="encrypted" tone="warning" :lines="WARNINGS" />
-
-      <BucketUnlockDialog
-        v-model:open="unlockOpen"
-        :bucket="bucket"
-        :max-unlock-ms="status.max_unlock_ms"
-        :unlock="encryption.unlock"
-      />
+      <Notice v-if="encrypted || keyCount" tone="warning" :lines="WARNINGS" />
     </template>
   </div>
 </template>
diff --git a/src/components/storage/BucketKeyAccess.vue b/src/components/storage/BucketKeyAccess.vue
new file mode 100644
index 00000000..5fc768bf
--- /dev/null
+++ b/src/components/storage/BucketKeyAccess.vue
@@ -0,0 +1,123 @@
+<script setup lang="ts">
+// Every key generation the node still needs, each with its fingerprint and lock
+// state: the active key, and the previous key while stored versions are rewritten.
+import { computed, reactive, ref } from 'vue'
+import BucketUnlockDialog from '@/components/storage/BucketUnlockDialog.vue'
+import Badge from '@/components/ui/Badge.vue'
+import Button from '@/components/ui/Button.vue'
+import Notice from '@/components/ui/Notice.vue'
+import Select from '@/components/ui/Select.vue'
+import type { BucketEncryptionResponse, BucketKeyGeneration } from '@/lib/api'
+import { ROLE_LABEL, durationOptions, encryptionError, keyGenerations, unlockView } from '@/lib/bucketEncryption'
+import { stateVariant } from '@/lib/stateBadge'
+import type { UnlockOutcome } from '@/lib/vault/bucketUnlock'
+
+const props = defineProps<{
+  bucket: string
+  status: BucketEncryptionResponse
+  busy: boolean
+  outcomeUnknown: boolean
+  unlock: (generation: number, durationMs?: number) => Promise<UnlockOutcome | null>
+  extend: (generation: number, durationMs?: number) => Promise<unknown>
+  lock: () => Promise<unknown>
+}>()
+
+const keys = computed(() => keyGenerations(props.status))
+const caller = computed(() => props.status.caller)
+const nodeManaged = computed(() => props.status.mode === 'node_managed')
+const extendOptions = computed(() => durationOptions(props.status.max_unlock_ms))
+const extendBy = reactive<Record<number, string>>({})
+const unlockTarget = ref<BucketKeyGeneration | null>(null)
+const actionError = ref<string | null>(null)
+
+function canUnlock(key: BucketKeyGeneration): boolean {
+  return key.unlock.state === 'locked' && caller.value.holder && (key.role === 'source' || caller.value.ready_copy)
+}
+
+function canExtend(key: BucketKeyGeneration): boolean {
+  return key.unlock.state === 'unlocked' && caller.value.holder && Boolean(key.unlock.session_id)
+}
+
+const canLock = computed(
+  () => keys.value.list.some((key) => key.unlock.state === 'unlocked') && (caller.value.holder || caller.value.admin),
+)
+const anyAction = computed(() => canLock.value || keys.value.list.some((key) => canUnlock(key) || canExtend(key)))
+
+async function act(work: () => Promise<unknown>) {
+  actionError.value = null
+  try {
+    await work()
+  } catch (cause) {
+    actionError.value = encryptionError(cause)
+  }
+}
+
+function extendKey(key: BucketKeyGeneration) {
+  const chosen = extendBy[key.generation]
+  return act(() => props.extend(key.generation, chosen ? Number(chosen) : undefined))
+}
+</script>
+
+<template>
+  <section class="surface" data-key-access>
+    <header class="flex items-center gap-2 border-b border-border px-5 py-4">
+      <h2 class="font-display text-sm font-semibold text-aruna-navy">Key access</h2>
+    </header>
+    <div class="space-y-3 px-5 py-4">
+      <Notice v-if="outcomeUnknown" tone="warning" title="The last unlock was not confirmed">
+        Read the state again before you try once more; the key is never sent twice on its own.
+      </Notice>
+      <Notice v-if="!keys.reported" tone="info">
+        The node did not list its key generations, so only the active key is shown.
+      </Notice>
+      <ul class="divide-y divide-border">
+        <li v-for="key in keys.list" :key="key.generation" class="space-y-1.5 py-3" :data-generation="key.generation">
+          <div class="flex flex-wrap items-center gap-2 text-sm">
+            <span class="font-medium text-foreground">{{ ROLE_LABEL[key.role] ?? 'Key' }}</span>
+            <span class="text-xs text-muted-foreground">generation {{ key.generation }}</span>
+            <Badge :variant="stateVariant(unlockView(key.unlock, nodeManaged).label)">
+              {{ unlockView(key.unlock, nodeManaged).label }}
+            </Badge>
+          </div>
+          <p class="break-all text-[11px] text-muted-foreground">
+            Fingerprint <span class="font-mono">{{ key.fingerprint }}</span>
+          </p>
+          <p class="text-xs text-muted-foreground">
+            {{ unlockView(key.unlock, nodeManaged).detail }}
+            <template v-if="key.role === 'source'">This key is needed until the stored versions are rewritten.</template>
+          </p>
+          <div class="flex flex-wrap items-center gap-2">
+            <Button v-if="canUnlock(key)" size="sm" :disabled="busy || outcomeUnknown" @click="unlockTarget = key">
+              Unlock
+            </Button>
+            <template v-if="canExtend(key)">
+              <Select
+                class="w-56"
+                :model-value="extendBy[key.generation] ?? ''"
+                :options="extendOptions"
+                aria-label="Extend the unlock by"
+                @update:model-value="(value: string) => (extendBy[key.generation] = value)"
+              />
+              <Button size="sm" variant="outline" :disabled="busy" @click="extendKey(key)">Extend</Button>
+            </template>
+          </div>
+        </li>
+      </ul>
+      <div class="flex flex-wrap items-center gap-2">
+        <Button v-if="canLock" size="sm" variant="outline" :disabled="busy" @click="act(lock)">Lock now</Button>
+        <span v-if="!anyAction" class="text-xs text-muted-foreground">No key action is open to you right now.</span>
+      </div>
+      <Notice v-if="actionError" tone="error">{{ actionError }}</Notice>
+    </div>
+
+    <BucketUnlockDialog
+      :open="unlockTarget !== null"
+      :bucket="bucket"
+      :generation="unlockTarget?.generation ?? 0"
+      :role="unlockTarget?.role ?? 'active'"
+      :max-unlock-ms="status.max_unlock_ms"
+      :unlock="unlock"
+      @update:open="(open: boolean) => !open && (unlockTarget = null)"
+    />
+  </section>
+</template>
diff --git a/src/components/storage/BucketUnlockDialog.test.ts b/src/components/storage/BucketUnlockDialog.test.ts
index c7740312..d7937119 100644
--- a/src/components/storage/BucketUnlockDialog.test.ts
+++ b/src/components/storage/BucketUnlockDialog.test.ts
@@ -54,8 +54,9 @@ const dialog = compileClientComponent(new URL('./BucketUnlockDialog.vue', import
   '@/lib/bucketEncryption': Wording,
 })
 
-async function render(maxUnlockMs: number | null = null) {
-  const { root } = await mountApp(dialog, { props: { open: true, bucket: 'reef', maxUnlockMs, unlock } })
+async function render(maxUnlockMs: number | null = null, role = 'active') {
+  const props = { open: true, bucket: 'reef', generation: 2, role, maxUnlockMs, unlock }
+  const { root } = await mountApp(dialog, { props })
   return root
 }
 
@@ -76,7 +77,7 @@ describe('bucket unlock dialog', () => {
     await flush()
     await click(button(root, 'Unlock'))
 
-    expect(unlock).toHaveBeenCalledWith(3_600_000)
+    expect(unlock).toHaveBeenCalledWith(2, 3_600_000)
     expect(content(root)).toContain('The node confirmed the unlock.')
   })
 
@@ -86,7 +87,11 @@ describe('bucket unlock dialog', () => {
     expect(content(root)).toContain('share one disk')
     await click(button(root, 'Unlock'))
 
-    expect(unlock).toHaveBeenCalledWith(undefined)
+    expect(unlock).toHaveBeenCalledWith(2, undefined)
+  })
+
+  it('names the previous key it unlocks', async () => {
+    expect(content(await render(null, 'source'))).toContain('It is the previous key')
   })
 
   it('asks for the passphrase first, or points to the vault setup', async () => {
diff --git a/src/components/storage/BucketUnlockDialog.vue b/src/components/storage/BucketUnlockDialog.vue
index a607f1fd..a8f40d22 100644
--- a/src/components/storage/BucketUnlockDialog.vue
+++ b/src/components/storage/BucketUnlockDialog.vue
@@ -16,13 +16,16 @@ import Select from '@/components/ui/Select.vue'
 import Spinner from '@/components/ui/Spinner.vue'
 import { useUserVault } from '@/composables/useUserVault'
 import { durationOptions, encryptionError } from '@/lib/bucketEncryption'
+import type { KeyRole } from '@/lib/api'
 import type { UnlockOutcome } from '@/lib/vault/bucketUnlock'
 
 const props = defineProps<{
   open: boolean
   bucket: string
+  generation: number
+  role: KeyRole
   maxUnlockMs: number | null
-  unlock: (durationMs?: number) => Promise<UnlockOutcome | null>
+  unlock: (generation: number, durationMs?: number) => Promise<UnlockOutcome | null>
 }>()
 const emit = defineEmits<{ (e: 'update:open', open: boolean): void }>()
 
@@ -58,7 +61,7 @@ async function submit() {
   busy.value = true
   failure.value = null
   try {
-    outcome.value = await props.unlock(duration.value ? Number(duration.value) : undefined)
+    outcome.value = await props.unlock(props.generation, duration.value ? Number(duration.value) : undefined)
     if (!outcome.value) failure.value = 'The bucket changed while it was being unlocked. Nothing was sent.'
   } catch (cause) {
     failure.value = encryptionError(cause)
@@ -74,8 +77,9 @@ async function submit() {
       <DialogHeader>
         <DialogTitle>Unlock {{ bucket }}</DialogTitle>
         <DialogDescription>
-          Your vault opens your copy of the bucket key in this browser. Only the bucket key and the unlock length go to
-          the node.
+          Your vault opens your copy of key generation {{ generation }} in this browser. Only that key and the unlock
+          length go to the node.
+          <template v-if="role === 'source'">It is the previous key, needed while stored versions are rewritten.</template>
         </DialogDescription>
       </DialogHeader>
 
diff --git a/src/composables/useBucketEncryption.flow.test.ts b/src/composables/useBucketEncryption.flow.test.ts
index a64d3587..e75f793d 100644
--- a/src/composables/useBucketEncryption.flow.test.ts
+++ b/src/composables/useBucketEncryption.flow.test.ts
@@ -129,7 +129,7 @@ describe('unlocking a vault-locked bucket from the browser', () => {
     const encryption = scope.run(() => useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1')))!
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
 
-    const outcome = await encryption.unlock(3_600_000)
+    const outcome = await encryption.unlock(copy.generation, 3_600_000)
 
     expect(outcome).toMatchObject({ kind: 'unlocked', ownKey: 'matches' })
     expect(encryption.status.value?.unlock?.state).toBe('unlocked')
@@ -161,7 +161,7 @@ describe('unlocking a vault-locked bucket from the browser', () => {
     const encryption = scope.run(() => useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1')))!
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
 
-    const pending = encryption.unlock()
+    const pending = encryption.unlock(copy.generation)
     state.sessionEpoch.value += 1
     const outcome = await pending.catch((error: unknown) => error)
 
diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
index 1bf3cfb3..40c54b20 100644
--- a/src/composables/useBucketEncryption.test.ts
+++ b/src/composables/useBucketEncryption.test.ts
@@ -120,7 +120,7 @@ describe('bucket encryption state', () => {
     unlockWithVault.mockResolvedValue({ kind: 'unlocked', status: { state: 'unlocked' }, ownKey: 'matches' })
     getBucketEncryption.mockResolvedValue(status({ unlock: { ...status().unlock!, state: 'unlocked', session_id: 'S2' } }))
 
-    const outcome = await encryption.unlock(60_000)
+    const outcome = await encryption.unlock(2, 60_000)
 
     expect(outcome?.kind).toBe('unlocked')
     const [target, vault, live] = unlockWithVault.mock.calls[0]
@@ -143,10 +143,10 @@ describe('bucket encryption state', () => {
     unlockWithVault.mockResolvedValue({ kind: 'unknown', ownKey: 'matches' })
     getBucketEncryption.mockRejectedValueOnce(new TypeError('network down'))
 
-    await encryption.unlock()
+    await encryption.unlock(2)
 
     expect(encryption.outcomeUnknown.value).toBe(true)
-    await expect(encryption.unlock()).rejects.toThrow('not confirmed')
+    await expect(encryption.unlock(2)).rejects.toThrow('not confirmed')
     expect(unlockWithVault).toHaveBeenCalledTimes(1)
     await encryption.load()
     expect(encryption.outcomeUnknown.value).toBe(false)
@@ -158,7 +158,7 @@ describe('bucket encryption state', () => {
     const pending = deferred<unknown>()
     unlockWithVault.mockReturnValue(pending.promise)
 
-    const answer = encryption.unlock()
+    const answer = encryption.unlock(2)
     await vi.waitFor(() => expect(unlockWithVault).toHaveBeenCalled())
     const live = unlockWithVault.mock.calls[0][2] as () => boolean
     sessionEpoch.value += 1
@@ -174,7 +174,7 @@ describe('bucket encryption state', () => {
     const pending = deferred<unknown>()
     unlockWithVault.mockReturnValue(pending.promise)
 
-    const answer = encryption.unlock()
+    const answer = encryption.unlock(2)
     await vi.waitFor(() => expect(unlockWithVault).toHaveBeenCalled())
     const live = unlockWithVault.mock.calls[0][2] as () => boolean
     bucket.value = 'other'
@@ -193,7 +193,7 @@ describe('bucket encryption state', () => {
     unlockWithVault.mockReturnValue(pending.promise)
     const loadsBefore = getBucketEncryption.mock.calls.length
 
-    const answer = encryption.unlock()
+    const answer = encryption.unlock(2)
     await vi.waitFor(() => expect(unlockWithVault).toHaveBeenCalled())
     const live = unlockWithVault.mock.calls[0][2] as () => boolean
     scope.stop()
@@ -204,15 +204,34 @@ describe('bucket encryption state', () => {
     expect(getBucketEncryption.mock.calls.length).toBe(loadsBefore)
   })
 
+  it('unlocks and extends a source key of a bucket whose new writes are not encrypted', async () => {
+    const locked = status().unlock!
+    const source = { generation: 1, role: 'source' as const, public_key: 'PK1', fingerprint: 'f1', unlock: locked }
+    getBucketEncryption.mockResolvedValue(
+      status({ mode: 'off', public_key: null, fingerprint: null, unlock: null, key_generation: 2, generations: [source] }),
+    )
+    const { encryption } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    unlockWithVault.mockResolvedValue({ kind: 'unlocked', status: {}, ownKey: 'matches' })
+
+    await encryption.unlock(1)
+    await expect(encryption.unlock(2)).rejects.toThrow('no such key')
+
+    const [target] = unlockWithVault.mock.calls[0]
+    expect(target.publicKey).toBe('PK1')
+    expect(target.context).toMatchObject({ bucketId: 'B1', generation: 1 })
+    await expect(encryption.extend(1)).rejects.toThrow('not unlocked')
+  })
+
   it('stops the unlock when the bucket key changes under it', async () => {
     const { encryption } = setup()
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
     unlockWithVault.mockImplementation(async (_target, _vault, live: () => boolean) => {
-      getBucketEncryption.mockResolvedValue(status({ key_generation: 3 }))
+      getBucketEncryption.mockResolvedValue(status({ public_key: 'PK-new' }))
       await encryption.load()
       return { kind: live() ? 'unlocked' : 'stale' }
     })
 
-    expect((await encryption.unlock())?.kind).toBe('stale')
+    expect((await encryption.unlock(2))?.kind).toBe('stale')
   })
 })
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index 51f3109e..c4b542d5 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -16,6 +16,7 @@ import {
   type BucketEncryptionResponse,
   type PutBucketEncryptionRequest,
 } from '@/lib/api'
+import { keyGenerations } from '@/lib/bucketEncryption'
 import { unlockWithVault, type UnlockOutcome } from '@/lib/vault/bucketUnlock'
 import { authToken, nodeInfo, realmInfo, sessionEpoch, userInfo } from './aruna/state'
 import { localNodeId, nodeApiBase } from './s3/endpoints'
@@ -120,16 +121,22 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     }
   }
 
-  /** Opens the caller's copy in this browser and sends only the bucket key to the node. */
-  function unlock(durationMs?: number): Promise<UnlockOutcome | null> {
-    const seen = status.value
+  /** The generation as the current status lists it, active or source. */
+  function keyOf(keyGeneration: number) {
+    return status.value ? keyGenerations(status.value).list.find((entry) => entry.generation === keyGeneration) : undefined
+  }
+
+  /** Opens the caller's copy of one generation here and sends only that key to the node. */
+  function unlock(keyGeneration: number, durationMs?: number): Promise<UnlockOutcome | null> {
     if (outcomeUnknown.value) {
       return Promise.reject(new Error('The last unlock was not confirmed. Reload the status before trying again.'))
     }
-    if (!seen?.bucket_id || !seen.public_key) return Promise.reject(new Error('This bucket has no key to unlock.'))
-    const { bucket_id: bucketId, key_generation: generation, public_key: publicKey } = seen
+    const bucketId = status.value?.bucket_id
+    const publicKey = keyOf(keyGeneration)?.public_key
+    if (!bucketId || !publicKey) return Promise.reject(new Error('This bucket has no such key to unlock.'))
+    const generation = keyGeneration
     return run('unlock', async (bound) => {
-      const live = () => bound() && status.value?.bucket_id === bucketId && status.value.key_generation === generation
+      const live = () => bound() && status.value?.bucket_id === bucketId && keyOf(generation)?.public_key === publicKey
       const { realmId, nodeId: node, userId } = scope.value
       const outcome = await unlockWithVault(
         {
@@ -147,9 +154,9 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     })
   }
 
-  function extend(durationMs?: number) {
-    const session = status.value?.unlock?.session_id
-    if (!session) return Promise.reject(new Error('The bucket is not unlocked.'))
+  function extend(keyGeneration: number, durationMs?: number) {
+    const session = keyOf(keyGeneration)?.unlock.session_id
+    if (!session) return Promise.reject(new Error('This key is not unlocked.'))
     return run('extend', () => extendUnlock(scope.value.bucket, { session_id: session, duration_ms: durationMs }, client()))
   }
 

From 8c38363fb7115ec378692e8c0c2ce73506e037ba Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:55:12 +0200
Subject: [PATCH 25/86] test: cover key access for active and previous
 generations

---
 .../storage/BucketKeyAccess.test.ts           | 139 ++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 src/components/storage/BucketKeyAccess.test.ts

diff --git a/src/components/storage/BucketKeyAccess.test.ts b/src/components/storage/BucketKeyAccess.test.ts
new file mode 100644
index 00000000..e0da70b1
--- /dev/null
+++ b/src/components/storage/BucketKeyAccess.test.ts
@@ -0,0 +1,139 @@
+import { defineComponent, h } from 'vue'
+import * as VueRuntime from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as Api from '@/lib/api'
+import type { BucketEncryptionResponse, BucketKeyGeneration, BucketUnlockStatus } from '@/lib/api'
+import * as Wording from '@/lib/bucketEncryption'
+import * as StateBadge from '@/lib/stateBadge'
+import { button, click, compileClientComponent, content, element, mountApp, moduleDefault } from '@/test/clientRender'
+
+const unlock = vi.fn()
+const extend = vi.fn()
+const lock = vi.fn()
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+const NoticeStub = defineComponent({
+  props: { title: String },
+  setup: (props, { slots }) => () => h('aside', [props.title, slots.default?.()]),
+})
+const DialogStub = defineComponent({
+  props: { open: Boolean, generation: Number, role: String },
+  setup: (props) => () => h('div', props.open ? `unlock dialog for ${props.role} ${props.generation}` : ''),
+})
+
+const access = compileClientComponent(new URL('./BucketKeyAccess.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@/components/storage/BucketUnlockDialog.vue': moduleDefault(DialogStub),
+  '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
+  '@/components/ui/Select.vue': moduleDefault(Slotted('select')),
+  '@/lib/bucketEncryption': Wording,
+  '@/lib/stateBadge': StateBadge,
+})
+
+const LOCKED: BucketUnlockStatus = {
+  state: 'locked',
+  lock_reason: 'restart',
+  locked_at_ms: 1,
+  session_id: null,
+  unlocked_at_ms: null,
+  deadline_ms: null,
+  max_deadline_ms: null,
+}
+const OPEN: BucketUnlockStatus = { ...LOCKED, state: 'unlocked', lock_reason: null, session_id: 'S1', deadline_ms: 9_000 }
+
+function key(generation: number, role: BucketKeyGeneration['role'], unlockState = LOCKED): BucketKeyGeneration {
+  return { generation, role, public_key: `PK${generation}`, fingerprint: `fingerprint-${generation}`, unlock: unlockState }
+}
+
+function status(overrides: Partial<BucketEncryptionResponse> = {}): BucketEncryptionResponse {
+  return {
+    bucket: 'reef',
+    mode: 'vault_locked',
+    bucket_id: 'B1',
+    storage_generation: 1,
+    key_generation: 2,
+    public_key: 'PK2',
+    fingerprint: 'fingerprint-2',
+    cipher: 'chacha20_poly1305',
+    block_keys: 'content_derived',
+    max_unlock_ms: null,
+    unlock: LOCKED,
+    generations: [key(2, 'active')],
+    holders: null,
+    recovery: null,
+    transition: null,
+    caller: { holder: true, ready_copy: true, admin: false },
+    ...overrides,
+  }
+}
+
+async function render(value: BucketEncryptionResponse, outcomeUnknown = false) {
+  const { root } = await mountApp(access, {
+    props: { bucket: 'reef', status: value, busy: false, outcomeUnknown, unlock, extend, lock },
+  })
+  return root
+}
+
+function row(root: Awaited<ReturnType<typeof render>>, generation: number) {
+  return element(root, (node) => node.tag === 'li' && node.props['data-generation'] === generation)
+}
+
+beforeEach(() => {
+  unlock.mockReset()
+  extend.mockReset().mockResolvedValue(null)
+  lock.mockReset().mockResolvedValue(null)
+})
+
+describe('bucket key access', () => {
+  it('lists each key the node still needs with its role, fingerprint and lock state', async () => {
+    const root = await render(status({ generations: [key(3, 'active', OPEN), key(2, 'source')] }))
+
+    expect(content(row(root, 3))).toContain('Active key')
+    expect(content(row(root, 3))).toContain('fingerprint-3')
+    expect(content(row(root, 3))).toContain('Timed unlock')
+    expect(content(row(root, 2))).toContain('Previous key')
+    expect(content(row(root, 2))).toContain('Locked since restart')
+    expect(content(row(root, 2))).toContain('needed until the stored versions are rewritten')
+  })
+
+  it('lets a key holder unlock the previous key of a bucket whose new writes are not encrypted', async () => {
+    const off = status({ mode: 'off', public_key: null, fingerprint: null, unlock: null, generations: [key(1, 'source')] })
+    const root = await render({ ...off, caller: { holder: true, ready_copy: false, admin: false } })
+
+    await click(button(row(root, 1), 'Unlock'))
+
+    expect(content(root)).toContain('unlock dialog for source 1')
+  })
+
+  it('extends the session of the chosen key and words a refused lock', async () => {
+    lock.mockRejectedValueOnce(new Api.ApiError(409, 'conflict', 'session_mismatch'))
+    const root = await render(status({ generations: [key(3, 'active'), key(2, 'source', OPEN)] }))
+
+    await click(button(row(root, 2), 'Extend'))
+    await click(button(root, 'Lock now'))
+
+    expect(extend).toHaveBeenCalledWith(2, undefined)
+    expect(lock).toHaveBeenCalledOnce()
+    expect(content(root)).toContain('locked or unlocked again meanwhile')
+  })
+
+  it('holds back a second unlock while the last one is unconfirmed', async () => {
+    const root = await render(status(), true)
+
+    expect(content(root)).toContain('The last unlock was not confirmed')
+    expect(button(root, 'Unlock').props.disabled).toBe(true)
+  })
+
+  it('offers a reader no key action and names a node that listed no generations', async () => {
+    const reader = { holder: false, ready_copy: false, admin: false }
+    const older = status({ caller: reader, generations: undefined, unlock: OPEN })
+    const root = await render(older)
+
+    expect(content(root)).toContain('No key action is open to you right now.')
+    expect(content(root)).toContain('did not list its key generations')
+    expect(content(row(root, 2))).toContain('Timed unlock')
+  })
+})

From 93d7439392ccbe0874dea6a166e4573c8a195be0 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:56:19 +0200
Subject: [PATCH 26/86] fix: keep an unconfirmed unlock and a retry visible
 when the state read fails

---
 .../storage/BucketEncryptionTab.test.ts       | 19 ++++++++++++++++---
 .../storage/BucketEncryptionTab.vue           |  4 ++++
 .../storage/BucketKeyAccess.test.ts           | 10 +++++++++-
 src/components/storage/BucketKeyAccess.vue    |  7 ++-----
 src/lib/bucketEncryption.ts                   |  8 ++++++++
 5 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index 87c299e8..dfd9f23d 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -1,11 +1,11 @@
 import { defineComponent, h, ref } from 'vue'
 import * as VueRuntime from 'vue'
-import { beforeEach, describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { BucketCompressionResponse, BucketEncryptionResponse } from '@/lib/api'
 import * as Wording from '@/lib/bucketEncryption'
 import * as StateBadge from '@/lib/stateBadge'
 import type { EncryptionLoadState } from '@/composables/useBucketEncryption'
-import { compileClientComponent, content, mountApp, moduleDefault } from '@/test/clientRender'
+import { click, compileClientComponent, content, element, mountApp, moduleDefault } from '@/test/clientRender'
 
 const status = ref<BucketEncryptionResponse | null>(null)
 const compression = ref<BucketCompressionResponse | null>(null)
@@ -30,6 +30,8 @@ const KeyAccessStub = defineComponent({
   setup: (props) => () => h('section', `key access for ${(props.status as BucketEncryptionResponse).bucket}`),
 })
 
+const load = vi.fn()
+
 const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
   vue: VueRuntime,
   '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
@@ -53,7 +55,7 @@ const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.m
       busy: ref(null),
       outcomeUnknown,
       nodeId: ref('node-b'),
-      load: () => undefined,
+      load,
     }),
   },
   '@/lib/bucketEncryption': Wording,
@@ -103,6 +105,7 @@ async function render(next: EncryptionLoadState, value: BucketEncryptionResponse
 
 beforeEach(() => {
   outcomeUnknown.value = false
+  load.mockReset()
 })
 
 describe('bucket encryption tab', () => {
@@ -114,6 +117,16 @@ describe('bucket encryption tab', () => {
     expect(await render('failed')).toContain('unknown until the node answers')
   })
 
+  it('keeps the unconfirmed unlock and a way to read again when the state read fails', async () => {
+    outcomeUnknown.value = true
+    const root = await mount('failed')
+
+    expect(content(root)).toContain('The last unlock was not confirmed')
+    expect(content(root)).toContain('Unlocking stays blocked')
+    await click(element(root, (node) => node.props.label === 'Read the state again'))
+    expect(load).toHaveBeenCalledOnce()
+  })
+
   it('shows the lock state, key, format and recovery of a vault-locked bucket', async () => {
     const text = await render('ready', encrypted())
 
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index 1d3703df..d5b11c75 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -79,6 +79,9 @@ const WARNINGS = [
 
 <template>
   <div class="space-y-5">
+    <Notice v-if="outcomeUnknown" tone="warning" title="The last unlock was not confirmed" data-unconfirmed>
+      Unlocking stays blocked until the node reports its state again; the key is never sent twice on its own.
+    </Notice>
     <SectionSkeleton v-if="state === 'loading'" label="Loading the encryption state" />
     <Notice v-else-if="state === 'missing'" tone="info" title="Encryption is not reported here">
       The node that hosts this bucket does not report its encryption. It may run an older Aruna version.
@@ -91,6 +94,7 @@ const WARNINGS = [
     </Notice>
     <Notice v-else-if="state === 'failed'" tone="error" :title="error ?? undefined">
       The encryption state is unknown until the node answers.
+      <RefreshButton class="mt-2" label="Read the state again" :busy="refreshing" @click="encryption.load()" />
     </Notice>
 
     <template v-else-if="status">
diff --git a/src/components/storage/BucketKeyAccess.test.ts b/src/components/storage/BucketKeyAccess.test.ts
index e0da70b1..1f2d56bb 100644
--- a/src/components/storage/BucketKeyAccess.test.ts
+++ b/src/components/storage/BucketKeyAccess.test.ts
@@ -108,6 +108,15 @@ describe('bucket key access', () => {
     expect(content(root)).toContain('unlock dialog for source 1')
   })
 
+  it('says an extension the node did not answer may or may not have applied', async () => {
+    extend.mockRejectedValueOnce(new Api.ApiError(503, 'unavailable'))
+    const root = await render(status({ generations: [key(2, 'active', OPEN)] }))
+
+    await click(button(root, 'Extend'))
+
+    expect(content(root)).toContain('did not confirm this change')
+  })
+
   it('extends the session of the chosen key and words a refused lock', async () => {
     lock.mockRejectedValueOnce(new Api.ApiError(409, 'conflict', 'session_mismatch'))
     const root = await render(status({ generations: [key(3, 'active'), key(2, 'source', OPEN)] }))
@@ -123,7 +132,6 @@ describe('bucket key access', () => {
   it('holds back a second unlock while the last one is unconfirmed', async () => {
     const root = await render(status(), true)
 
-    expect(content(root)).toContain('The last unlock was not confirmed')
     expect(button(root, 'Unlock').props.disabled).toBe(true)
   })
 
diff --git a/src/components/storage/BucketKeyAccess.vue b/src/components/storage/BucketKeyAccess.vue
index 5fc768bf..1325ef45 100644
--- a/src/components/storage/BucketKeyAccess.vue
+++ b/src/components/storage/BucketKeyAccess.vue
@@ -8,7 +8,7 @@ import Button from '@/components/ui/Button.vue'
 import Notice from '@/components/ui/Notice.vue'
 import Select from '@/components/ui/Select.vue'
 import type { BucketEncryptionResponse, BucketKeyGeneration } from '@/lib/api'
-import { ROLE_LABEL, durationOptions, encryptionError, keyGenerations, unlockView } from '@/lib/bucketEncryption'
+import { ROLE_LABEL, actionError as actionMessage, durationOptions, keyGenerations, unlockView } from '@/lib/bucketEncryption'
 import { stateVariant } from '@/lib/stateBadge'
 import type { UnlockOutcome } from '@/lib/vault/bucketUnlock'
 
@@ -48,7 +48,7 @@ async function act(work: () => Promise<unknown>) {
   try {
     await work()
   } catch (cause) {
-    actionError.value = encryptionError(cause)
+    actionError.value = actionMessage(cause)
   }
 }
 
@@ -64,9 +64,6 @@ function extendKey(key: BucketKeyGeneration) {
       <h2 class="font-display text-sm font-semibold text-aruna-navy">Key access</h2>
     </header>
     <div class="space-y-3 px-5 py-4">
-      <Notice v-if="outcomeUnknown" tone="warning" title="The last unlock was not confirmed">
-        Read the state again before you try once more; the key is never sent twice on its own.
-      </Notice>
       <Notice v-if="!keys.reported" tone="info">
         The node did not list its key generations, so only the active key is shown.
       </Notice>
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index a01cc49f..79fafa0f 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -256,6 +256,14 @@ export function encryptionError(error: unknown): string {
   return REFUSALS[code] ?? apiErrorMessage(error)
 }
 
+/** Only a 4xx says a change was not applied; a 5xx or a lost answer leaves it open. */
+export function actionError(error: unknown): string {
+  const uncertain = !(error instanceof ApiError) || error.status >= 500
+  return uncertain
+    ? 'The node did not confirm this change. The state shown is what it reports now; check it before you retry.'
+    : encryptionError(error)
+}
+
 /** The settings an admin may change with PUT; the key generation is the one shown. */
 export interface EncryptionDraft {
   mode: EncryptionMode

From 98ac079fbdac12ff280be1a54ff940eefb1469f4 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:57:42 +0200
Subject: [PATCH 27/86] fix: keep an edited encryption draft and confirm
 against the shown settings

---
 .../storage/BucketEncryptionSettings.test.ts  |  44 +++++++-
 .../storage/BucketEncryptionSettings.vue      | 103 +++++++++++++-----
 src/composables/useBucketEncryption.ts        |   6 +-
 3 files changed, 118 insertions(+), 35 deletions(-)

diff --git a/src/components/storage/BucketEncryptionSettings.test.ts b/src/components/storage/BucketEncryptionSettings.test.ts
index 39ff088e..95b6a975 100644
--- a/src/components/storage/BucketEncryptionSettings.test.ts
+++ b/src/components/storage/BucketEncryptionSettings.test.ts
@@ -1,4 +1,4 @@
-import { defineComponent, h } from 'vue'
+import { defineComponent, h, ref } from 'vue'
 import * as VueRuntime from 'vue'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import * as Api from '@/lib/api'
@@ -58,11 +58,25 @@ function status(overrides: Partial<BucketEncryptionResponse> = {}): BucketEncryp
 
 const UNLOCKED = { state: 'unlocked' as const, lock_reason: null, locked_at_ms: null, session_id: 'S', unlocked_at_ms: 1, deadline_ms: null, max_deadline_ms: null }
 
+const shown = ref<BucketEncryptionResponse | null>(null)
+const Host = defineComponent(() => () => h(settings, { status: shown.value, busy: false, save, rotate }))
+
 async function render(value: BucketEncryptionResponse) {
-  const { root } = await mountApp(settings, { props: { status: value, busy: false, save, rotate } })
+  shown.value = value
+  const { root } = await mountApp(Host)
   return root
 }
 
+/** The node answers again, as after a refresh or another admin's change. */
+async function replace(value: BucketEncryptionResponse) {
+  shown.value = value
+  await flush()
+}
+
+function selected(root: Awaited<ReturnType<typeof render>>, label: string): unknown {
+  return element(root, (node) => node.tag === 'select' && node.props['aria-label'] === label).props.modelValue
+}
+
 function dialog(root: Awaited<ReturnType<typeof render>>) {
   return element(root, (node) => node.props['data-dialog'] === true)
 }
@@ -116,7 +130,31 @@ describe('bucket encryption settings', () => {
     expect(content(root)).toContain('does not invalidate an old backup')
     await click(button(dialog(root), 'Rotate'))
 
-    expect(rotate).toHaveBeenCalledOnce()
+    expect(rotate).toHaveBeenCalledWith(5)
     expect(content(root)).toContain('Uploads to this bucket are still open')
   })
+
+  it('keeps a changed draft when the node answers again, and follows it otherwise', async () => {
+    const root = await render(status({ mode: 'vault_locked', unlock: UNLOCKED }))
+
+    await choose(root, 'Encryption mode', 'off')
+    await replace(status({ mode: 'vault_locked', unlock: UNLOCKED }))
+    expect(selected(root, 'Encryption mode')).toBe('off')
+
+    await click(button(root, 'Discard'))
+    await replace(status({ mode: 'vault_locked', unlock: UNLOCKED, max_unlock_ms: 3_600_000 }))
+    expect(selected(root, 'Longest unlock')).toBe('3600000')
+  })
+
+  it('asks again when the bucket changes while a confirmation is open', async () => {
+    const root = await render(status({ unlock: UNLOCKED }))
+
+    await click(button(root, 'Rotate key'))
+    await replace(status({ unlock: UNLOCKED, key_generation: 6 }))
+
+    expect(content(dialog(root))).toContain('review the change again')
+    expect(button(dialog(root), 'Rotate').props.disabled).toBe(true)
+    await click(button(dialog(root), 'Rotate'))
+    expect(rotate).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/components/storage/BucketEncryptionSettings.vue b/src/components/storage/BucketEncryptionSettings.vue
index 6c8f97f6..eb4316bc 100644
--- a/src/components/storage/BucketEncryptionSettings.vue
+++ b/src/components/storage/BucketEncryptionSettings.vue
@@ -18,8 +18,8 @@ import {
   MODE_LABEL,
   ROTATION_NOTES,
   changeNeedsUnlock,
+  actionError,
   changeNotes,
-  encryptionError,
   maxUnlockOptions,
   type EncryptionDraft,
 } from '@/lib/bucketEncryption'
@@ -28,23 +28,38 @@ const props = defineProps<{
   status: BucketEncryptionResponse
   busy: boolean
   save: (request: EncryptionDraft & { expected_generation: number }) => Promise<unknown>
-  rotate: () => Promise<unknown>
+  rotate: (expectedGeneration: number) => Promise<unknown>
 }>()
 
 const mode = ref<EncryptionMode>('off')
 const cipher = ref<BlockCipher>('chacha20_poly1305')
 const blockKeys = ref<BlockKeys>('content_derived')
 const maxUnlock = ref('')
-const confirming = ref<'save' | 'rotate' | null>(null)
 const failure = ref<string | null>(null)
 
+function settingsOf(status: BucketEncryptionResponse): EncryptionDraft {
+  return { mode: status.mode, cipher: status.cipher, block_keys: status.block_keys, max_unlock_ms: status.max_unlock_ms }
+}
+
+function same(a: EncryptionDraft, b: EncryptionDraft): boolean {
+  return a.mode === b.mode && a.cipher === b.cipher && a.block_keys === b.block_keys && a.max_unlock_ms === b.max_unlock_ms
+}
+
+function apply(next: EncryptionDraft) {
+  mode.value = next.mode
+  cipher.value = next.cipher
+  blockKeys.value = next.block_keys
+  maxUnlock.value = next.max_unlock_ms === null ? '' : String(next.max_unlock_ms)
+}
+
+/** The node's settings the draft started from; a refresh keeps a draft that differs from them. */
+const base = ref<EncryptionDraft>(settingsOf(props.status))
+apply(base.value)
+
 function reset() {
-  mode.value = props.status.mode
-  cipher.value = props.status.cipher
-  blockKeys.value = props.status.block_keys
-  maxUnlock.value = props.status.max_unlock_ms === null ? '' : String(props.status.max_unlock_ms)
+  base.value = settingsOf(props.status)
+  apply(base.value)
 }
-watch(() => props.status, reset, { immediate: true })
 
 const options = (labels: Record<string, string>) => Object.entries(labels).map(([value, label]) => ({ value, label }))
 const draft = computed<EncryptionDraft>(() => ({
@@ -53,27 +68,56 @@ const draft = computed<EncryptionDraft>(() => ({
   block_keys: blockKeys.value,
   max_unlock_ms: maxUnlock.value ? Number(maxUnlock.value) : null,
 }))
-const changed = computed(
-  () =>
-    draft.value.mode !== props.status.mode ||
-    draft.value.cipher !== props.status.cipher ||
-    draft.value.block_keys !== props.status.block_keys ||
-    draft.value.max_unlock_ms !== props.status.max_unlock_ms,
+const changed = computed(() => !same(draft.value, base.value))
+watch(
+  () => props.status,
+  (next) => {
+    if (!changed.value) apply(settingsOf(next))
+    base.value = settingsOf(next)
+  },
 )
 const locked = computed(() => props.status.unlock?.state !== 'unlocked')
 const blockedByLock = computed(() => locked.value && changeNeedsUnlock(props.status, draft.value))
 const notes = computed(() => changeNotes(props.status, draft.value))
 const canRotate = computed(() => props.status.mode !== 'off' && !locked.value)
 
+/** What a confirmation was opened for; a change of the bucket under it asks for a new one. */
+interface Pending {
+  action: 'save' | 'rotate'
+  draft: EncryptionDraft
+  generation: number
+  notes: string[]
+  context: string
+}
+const pending = ref<Pending | null>(null)
+
+function contextOf(status: BucketEncryptionResponse): string {
+  return JSON.stringify([status.bucket_id, status.key_generation, status.storage_generation, settingsOf(status)])
+}
+
+const stale = computed(() => pending.value !== null && pending.value.context !== contextOf(props.status))
+
+function ask(action: Pending['action']) {
+  failure.value = null
+  pending.value = {
+    action,
+    draft: { ...draft.value },
+    generation: props.status.key_generation,
+    notes: action === 'rotate' ? ROTATION_NOTES : notes.value,
+    context: contextOf(props.status),
+  }
+}
+
 async function confirm() {
-  const action = confirming.value
+  const asked = pending.value
+  if (!asked || stale.value) return
   failure.value = null
   try {
-    if (action === 'save') await props.save({ ...draft.value, expected_generation: props.status.key_generation })
-    else if (action === 'rotate') await props.rotate()
-    confirming.value = null
+    if (asked.action === 'save') await props.save({ ...asked.draft, expected_generation: asked.generation })
+    else await props.rotate(asked.generation)
+    if (pending.value === asked) pending.value = null
   } catch (cause) {
-    failure.value = encryptionError(cause)
+    failure.value = actionError(cause)
   }
 }
 </script>
@@ -105,7 +149,7 @@ async function confirm() {
       <Notice v-if="changed && notes.length" tone="info" :lines="notes" />
       <Notice v-if="changed && blockedByLock" tone="warning">Unlock the bucket first; this change reads the stored data.</Notice>
       <div class="flex flex-wrap items-center gap-2">
-        <Button size="sm" :disabled="!changed || blockedByLock || busy" @click="confirming = 'save'">Save changes</Button>
+        <Button size="sm" :disabled="!changed || blockedByLock || busy" @click="ask('save')">Save changes</Button>
         <Button v-if="changed" size="sm" variant="outline" :disabled="busy" @click="reset">Discard</Button>
         <Button
           v-if="status.mode !== 'off'"
@@ -113,7 +157,7 @@ async function confirm() {
           size="sm"
           variant="outline"
           :disabled="!canRotate || busy"
-          @click="confirming = 'rotate'"
+          @click="ask('rotate')"
         >
           Rotate key
         </Button>
@@ -121,22 +165,25 @@ async function confirm() {
       <p v-if="status.mode !== 'off' && locked" class="text-[11px] text-muted-foreground">
         Rotation needs the bucket unlocked.
       </p>
-      <Notice v-if="failure && !confirming" tone="error">{{ failure }}</Notice>
+      <Notice v-if="failure && !pending" tone="error">{{ failure }}</Notice>
     </div>
 
-    <Dialog :open="confirming !== null" @update:open="(open: boolean) => !open && (confirming = null)">
+    <Dialog :open="pending !== null" @update:open="(open: boolean) => !open && (pending = null)">
       <DialogContent class="max-w-md">
         <DialogHeader>
-          <DialogTitle>{{ confirming === 'rotate' ? 'Rotate the bucket key?' : 'Change the encryption?' }}</DialogTitle>
+          <DialogTitle>{{ pending?.action === 'rotate' ? 'Rotate the bucket key?' : 'Change the encryption?' }}</DialogTitle>
           <DialogDescription>
-            {{ confirming === 'rotate' ? 'Open uploads must finish first.' : 'Open uploads must finish first; new writes follow the new setting.' }}
+            {{ pending?.action === 'rotate' ? 'Open uploads must finish first.' : 'Open uploads must finish first; new writes follow the new setting.' }}
           </DialogDescription>
         </DialogHeader>
-        <Notice v-if="confirming === 'rotate' || notes.length" tone="warning" :lines="confirming === 'rotate' ? ROTATION_NOTES : notes" />
+        <Notice v-if="pending?.notes.length" tone="warning" :lines="pending.notes" />
+        <Notice v-if="stale" tone="warning">
+          The bucket settings or its key changed while this was open. Close it and review the change again.
+        </Notice>
         <Notice v-if="failure" tone="error">{{ failure }}</Notice>
         <DialogFooter>
-          <Button variant="outline" size="sm" @click="confirming = null">Cancel</Button>
-          <Button size="sm" :disabled="busy" @click="confirm">{{ confirming === 'rotate' ? 'Rotate' : 'Save' }}</Button>
+          <Button variant="outline" size="sm" @click="pending = null">Cancel</Button>
+          <Button size="sm" :disabled="busy || stale" @click="confirm">{{ pending?.action === 'rotate' ? 'Rotate' : 'Save' }}</Button>
         </DialogFooter>
       </DialogContent>
     </Dialog>
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index c4b542d5..2d69a6ef 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -168,10 +168,8 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     return run('save', () => putBucketEncryption(scope.value.bucket, request, client()))
   }
 
-  function rotate() {
-    const generation = status.value?.key_generation
-    if (generation === undefined) return Promise.reject(new Error('The bucket status is not known.'))
-    return run('rotate', () => rotateBucketKey(scope.value.bucket, generation, client()))
+  function rotate(expectedGeneration: number) {
+    return run('rotate', () => rotateBucketKey(scope.value.bucket, expectedGeneration, client()))
   }
 
   watch(

From 42744c5f0ec8a84a43fad90ffbbd21d77e8a2561 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 12:59:25 +0200
Subject: [PATCH 28/86] fix: bind key holders to the bucket key and read them
 after every key change

---
 .../storage/BucketHoldersSection.vue          |  3 +-
 src/composables/useBucketEncryption.test.ts   |  1 +
 src/composables/useBucketEncryption.ts        |  4 ++
 src/composables/useBucketHolders.test.ts      | 67 +++++++++++++++----
 src/composables/useBucketHolders.ts           | 30 +++++++--
 5 files changed, 86 insertions(+), 19 deletions(-)

diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index af6759f6..3a3a8932 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -24,8 +24,7 @@ import { shortUserId } from '@/lib/utils'
 const props = defineProps<{ bucket: string; canManage: boolean; source: HolderSource }>()
 
 const { searchUsers } = useAruna()
-const { holders, state, error, load, grant, remove } = useBucketHolders(props.source, toRef(props, 'bucket'))
-watch(() => props.bucket, () => void load(), { immediate: true })
+const { holders, state, error, grant, remove } = useBucketHolders(props.source, toRef(props, 'bucket'))
 
 const list = computed(() => holders.value?.holders ?? [])
 const recovery = computed(() => recoverySummary(holders.value?.recovery ?? null))
diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
index 40c54b20..72fddc4d 100644
--- a/src/composables/useBucketEncryption.test.ts
+++ b/src/composables/useBucketEncryption.test.ts
@@ -134,6 +134,7 @@ describe('bucket encryption state', () => {
     expect(vault).toEqual({ name: 'vault' })
     expect(live()).toBe(true)
     expect(encryption.status.value?.unlock?.session_id).toBe('S2')
+    expect(encryption.revision.value).toBe(2)
     expect(encryption.busy.value).toBeNull()
   })
 
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index 2d69a6ef..eb615daa 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -34,6 +34,8 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
   const error = ref<string | null>(null)
   const refreshing = ref(false)
   const busy = ref<EncryptionAction | null>(null)
+  /** Counts successful status reads. */
+  const revision = ref(0)
   /** An unlock whose answer never came; only a successful status read clears it. */
   const outcomeUnknown = ref(false)
   // Grows on every context change and on disposal and never goes back, so a
@@ -91,6 +93,7 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     compression.value = compressed.status === 'fulfilled' ? compressed.value : null
     if (encryption.status === 'fulfilled') {
       status.value = encryption.value
+      revision.value += 1
       state.value = 'ready'
       error.value = null
       outcomeUnknown.value = false
@@ -199,6 +202,7 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     refreshing,
     busy,
     outcomeUnknown,
+    revision,
     nodeId: computed(() => scope.value.nodeId || null),
     load,
     unlock,
diff --git a/src/composables/useBucketHolders.test.ts b/src/composables/useBucketHolders.test.ts
index e2d48780..4f8847be 100644
--- a/src/composables/useBucketHolders.test.ts
+++ b/src/composables/useBucketHolders.test.ts
@@ -1,7 +1,7 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { ref } from 'vue'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { effectScope, ref } from 'vue'
 import * as Api from '@/lib/api'
-import type { BucketHolderEntry, BucketHoldersResponse } from '@/lib/api'
+import type { BucketEncryptionResponse, BucketHolderEntry, BucketHoldersResponse } from '@/lib/api'
 import { breaksRecovery, useBucketHolders } from './useBucketHolders'
 
 const listBucketHolders = vi.fn()
@@ -33,7 +33,22 @@ function listing(entries: BucketHolderEntry[], revision = 'rev-1'): BucketHolder
 
 const NODE = { baseUrl: 'https://b.test/api/v1', token: 't' }
 let current = true
-const source = { client: () => NODE, binder: () => () => current, load: vi.fn(async () => undefined) }
+const shown = ref<BucketEncryptionResponse | null>({ bucket_id: 'B1', key_generation: 2 } as BucketEncryptionResponse)
+const revision = ref(0)
+const source = {
+  client: () => NODE,
+  binder: () => () => current,
+  load: vi.fn(async () => {
+    revision.value += 1
+  }),
+  status: shown,
+  revision,
+}
+let scope = effectScope()
+
+function holdersOf(bucket = 'reef') {
+  return scope.run(() => useBucketHolders(source, ref(bucket)))!
+}
 
 function refusal(code: string) {
   return new Api.ApiError(409, 'conflict', code)
@@ -41,12 +56,18 @@ function refusal(code: string) {
 
 beforeEach(() => {
   current = true
+  shown.value = { bucket_id: 'B1', key_generation: 2 } as BucketEncryptionResponse
   source.load.mockClear()
   listBucketHolders.mockReset().mockResolvedValue(listing([holder('A'), holder('B')]))
   removeBucketHolder.mockReset().mockResolvedValue(undefined)
   grantBucketHolder.mockReset().mockResolvedValue(holder('C', { state: 'pending' }))
 })
 
+afterEach(() => {
+  scope.stop()
+  scope = effectScope()
+})
+
 describe('bucket key holders', () => {
   it('foresees a removal that breaks recovery', () => {
     expect(breaksRecovery([holder('A'), holder('B')], 'A')).toBe(true)
@@ -57,18 +78,19 @@ describe('bucket key holders', () => {
   })
 
   it('drops a holder list that arrives after the bucket changed', async () => {
-    const holders = useBucketHolders(source, ref('reef'))
     current = false
+    const holders = holdersOf()
 
     await holders.load()
 
+    expect(listBucketHolders).toHaveBeenCalledTimes(2)
     expect(holders.holders.value).toBeNull()
     expect(holders.state.value).toBe('loading')
   })
 
   it('asks for confirmation when the node says the removal breaks recovery', async () => {
-    const holders = useBucketHolders(source, ref('reef'))
-    await holders.load()
+    const holders = holdersOf()
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
     removeBucketHolder.mockRejectedValueOnce(refusal('recovery_confirmation_required'))
 
     expect(await holders.remove('A', false)).toBe('confirm')
@@ -82,23 +104,44 @@ describe('bucket key holders', () => {
   })
 
   it('reloads a holder set that changed meanwhile instead of removing from it', async () => {
-    const holders = useBucketHolders(source, ref('reef'))
-    await holders.load()
+    const holders = holdersOf()
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
     removeBucketHolder.mockRejectedValueOnce(refusal('stale_holders'))
     listBucketHolders.mockResolvedValue(listing([holder('A'), holder('B'), holder('C')], 'rev-2'))
 
     await expect(holders.remove('A', false)).rejects.toThrow('changed meanwhile')
 
-    expect(holders.holders.value?.revision).toBe('rev-2')
+    await vi.waitFor(() => expect(holders.holders.value?.revision).toBe('rev-2'))
   })
 
   it('grants a holder and reads both the list and the bucket status again', async () => {
-    const holders = useBucketHolders(source, ref('reef'))
+    const holders = holdersOf()
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
 
     await holders.grant('C')
 
     expect(grantBucketHolder.mock.calls[0].slice(0, 2)).toEqual(['reef', 'C'])
-    expect(listBucketHolders).toHaveBeenCalledOnce()
     expect(source.load).toHaveBeenCalledOnce()
+    await vi.waitFor(() => expect(listBucketHolders).toHaveBeenCalledTimes(2))
+  })
+
+  it('starts empty for another key generation and drops the list of the old one', async () => {
+    const holders = holdersOf()
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
+    const answers: ((value: BucketHoldersResponse) => void)[] = []
+    listBucketHolders.mockImplementation(() => new Promise((resolve) => answers.push(resolve)))
+    revision.value += 1
+    await vi.waitFor(() => expect(answers).toHaveLength(1))
+
+    shown.value = { bucket_id: 'B1', key_generation: 3 } as BucketEncryptionResponse
+    await vi.waitFor(() => expect(answers).toHaveLength(2))
+    expect(holders.holders.value).toBeNull()
+    answers[0](listing([holder('OLD')]))
+    await Promise.resolve()
+    expect(holders.holders.value).toBeNull()
+    answers[1](listing([holder('NEW')]))
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
+
+    expect(holders.holders.value?.holders.map((entry) => entry.user_id)).toEqual(['NEW'])
   })
 })
diff --git a/src/composables/useBucketHolders.ts b/src/composables/useBucketHolders.ts
index 50f3b8c9..425b11f4 100644
--- a/src/composables/useBucketHolders.ts
+++ b/src/composables/useBucketHolders.ts
@@ -1,7 +1,7 @@
 // Key holders of one encrypted bucket, asked of the node that hosts it. Removal
 // names the holder revision it saw, so a changed set is refused, and breaking
 // the recovery rule needs an explicit confirmation.
-import { ref, type Ref } from 'vue'
+import { computed, ref, watch, type Ref } from 'vue'
 import {
   ApiError,
   ENCRYPTION_CODES,
@@ -10,6 +10,7 @@ import {
   listBucketHolders,
   removeBucketHolder,
   type ApiClientOptions,
+  type BucketEncryptionResponse,
   type BucketHolderEntry,
   type BucketHoldersResponse,
 } from '@/lib/api'
@@ -19,6 +20,9 @@ export interface HolderSource {
   client(): ApiClientOptions
   binder(): () => boolean
   load(): Promise<void>
+  status: Ref<BucketEncryptionResponse | null>
+  /** Grows with every status read, so key actions and refreshes read the holders again. */
+  revision: Ref<number>
 }
 
 export type HoldersState = 'loading' | 'ready' | 'refused' | 'failed'
@@ -36,19 +40,22 @@ export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
   const state = ref<HoldersState>('loading')
   const error = ref<string | null>(null)
   let loads = 0
+  // Holders belong to one bucket identity and key generation; another one starts empty.
+  const identity = computed(() => `${bucket.value}/${source.status.value?.bucket_id ?? ''}/${source.status.value?.key_generation ?? ''}`)
 
   async function load(): Promise<void> {
     const run = ++loads
     const bound = source.binder()
+    const seen = identity.value
     state.value = holders.value ? state.value : 'loading'
     try {
       const response = await listBucketHolders(bucket.value, source.client())
-      if (!bound() || run !== loads) return
+      if (!bound() || run !== loads || identity.value !== seen) return
       holders.value = response
       state.value = 'ready'
       error.value = null
     } catch (cause) {
-      if (!bound() || run !== loads) return
+      if (!bound() || run !== loads || identity.value !== seen) return
       holders.value = null
       const refused = cause instanceof ApiError && (cause.status === 401 || cause.status === 403)
       state.value = refused ? 'refused' : 'failed'
@@ -56,11 +63,24 @@ export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
     }
   }
 
+  /** A new status read bumps the revision, which reads the holders again. */
   async function refresh(bound: () => boolean) {
-    if (!bound()) return
-    await Promise.all([load(), source.load()])
+    if (bound()) await source.load()
   }
 
+  watch(
+    identity,
+    () => {
+      loads += 1
+      holders.value = null
+      state.value = 'loading'
+      error.value = null
+      void load()
+    },
+    { immediate: true },
+  )
+  watch(source.revision, () => void load())
+
   async function grant(userId: string): Promise<void> {
     const bound = source.binder()
     try {

From cfbcc699f96c77b7d2b61b468960f2ad62413cb3 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:01:19 +0200
Subject: [PATCH 29/86] fix: show a partial holder list and word a removal
 whose recovery is unsure

---
 .../storage/BucketHoldersSection.test.ts      | 25 ++++++++---
 .../storage/BucketHoldersSection.vue          | 44 +++++++++++++++----
 src/composables/useBucketHolders.test.ts      | 33 +++++++++++---
 src/composables/useBucketHolders.ts           | 19 ++++++--
 src/lib/api/bucketEncryption.ts               |  4 ++
 5 files changed, 100 insertions(+), 25 deletions(-)

diff --git a/src/components/storage/BucketHoldersSection.test.ts b/src/components/storage/BucketHoldersSection.test.ts
index 325c827a..5a1493f7 100644
--- a/src/components/storage/BucketHoldersSection.test.ts
+++ b/src/components/storage/BucketHoldersSection.test.ts
@@ -5,7 +5,7 @@ import type { BucketHolderEntry, BucketHoldersResponse } from '@/lib/api'
 import * as Wording from '@/lib/bucketEncryption'
 import * as StateBadge from '@/lib/stateBadge'
 import * as Utils from '@/lib/utils'
-import { breaksRecovery, type HoldersState } from '@/composables/useBucketHolders'
+import { listedRecovery, recoveryAfter, type HoldersState } from '@/composables/useBucketHolders'
 import { button, click, compileClientComponent, content, element, mountApp, moduleDefault } from '@/test/clientRender'
 
 const holders = ref<BucketHoldersResponse | null>(null)
@@ -35,7 +35,8 @@ const section = compileClientComponent(new URL('./BucketHoldersSection.vue', imp
   '@/components/ui/Spinner.vue': moduleDefault(defineComponent(() => () => h('span', 'loading'))),
   '@/composables/useAruna': { useAruna: () => ({ searchUsers: async () => ({ users: [] }) }) },
   '@/composables/useBucketHolders': {
-    breaksRecovery,
+    listedRecovery,
+    recoveryAfter,
     useBucketHolders: () => ({ holders, state, error: ref('The directory did not answer.'), load: vi.fn(), grant: vi.fn(), remove }),
   },
   '@/lib/bucketEncryption': Wording,
@@ -47,8 +48,9 @@ function holder(userId: string, overrides: Partial<BucketHolderEntry> = {}): Buc
   return { user_id: userId, name: userId, origin: 'explicit', state: 'ready', has_recovery: false, granted_by: null, granted_at_ms: null, ...overrides }
 }
 
-async function render(entries: BucketHolderEntry[], canManage = true) {
-  holders.value = { holders: entries, recovery: { state: 'met', ready_holders: 2, ready_with_recovery: 0 }, revision: 'rev-1' }
+async function render(entries: BucketHolderEntry[], canManage = true, complete = true) {
+  const recovery = { state: complete ? ('met' as const) : ('degraded' as const), ready_holders: 2, ready_with_recovery: 0 }
+  holders.value = { holders: entries, complete, unresolved: complete ? 0 : 2, recovery, revision: 'rev-1' }
   const source = { client: () => ({}), binder: () => () => true, load: async () => undefined }
   const { root } = await mountApp(section, { props: { bucket: 'reef', canManage, source } })
   return root
@@ -88,7 +90,8 @@ describe('bucket key holder list', () => {
 
     await click(rowButton(root, 'Bo'))
     expect(remove).not.toHaveBeenCalled()
-    expect(content(root)).toContain('cannot be read again')
+    expect(content(root)).toContain('the recovery rule is not met')
+    expect(content(root)).toContain('If the remaining usable key is then lost too')
     expect(button(root, 'Remove anyway').props.disabled).toBe(true)
     await click(element(root, (node) => node.tag === 'input' && node.props.type === 'checkbox'))
     await click(button(root, 'Remove anyway'))
@@ -96,6 +99,18 @@ describe('bucket key holder list', () => {
     expect(remove).toHaveBeenCalledWith('Bo', true)
   })
 
+  it('marks a partial list and asks before a removal whose effect cannot be verified', async () => {
+    const root = await render([holder('Ada'), holder('Bo')], true, false)
+
+    expect(content(root)).toContain('2 key holders could not be looked up, so this list is partial.')
+    expect(content(root)).toContain('Recovery: Unknown')
+    await click(rowButton(root, 'Bo'))
+
+    expect(remove).not.toHaveBeenCalled()
+    expect(content(root)).toContain('the recovery rule cannot be verified')
+    expect(content(root)).toContain('I accept that recovery cannot be verified.')
+  })
+
   it('asks when the node says the removal breaks recovery', async () => {
     remove.mockResolvedValueOnce('confirm')
     const root = await render([holder('Ada'), holder('Bo'), holder('Cy')])
diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index 3a3a8932..d435519f 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -15,7 +15,13 @@ import Input from '@/components/ui/Input.vue'
 import Notice from '@/components/ui/Notice.vue'
 import Spinner from '@/components/ui/Spinner.vue'
 import { useAruna } from '@/composables/useAruna'
-import { breaksRecovery, useBucketHolders, type HolderSource } from '@/composables/useBucketHolders'
+import {
+  listedRecovery,
+  recoveryAfter,
+  useBucketHolders,
+  type HolderSource,
+  type RecoveryAfter,
+} from '@/composables/useBucketHolders'
 import type { BucketHolderEntry, UserSearchHit } from '@/lib/api'
 import { HOLDER_STATE_LABEL, ORIGIN_LABEL, encryptionError, recoverySummary } from '@/lib/bucketEncryption'
 import { stateVariant } from '@/lib/stateBadge'
@@ -27,10 +33,12 @@ const { searchUsers } = useAruna()
 const { holders, state, error, grant, remove } = useBucketHolders(props.source, toRef(props, 'bucket'))
 
 const list = computed(() => holders.value?.holders ?? [])
-const recovery = computed(() => recoverySummary(holders.value?.recovery ?? null))
+const recovery = computed(() => recoverySummary(holders.value ? listedRecovery(holders.value) : null))
+const partial = computed(() => Boolean(holders.value && holders.value.complete !== true))
 const busy = ref<string | null>(null)
 const failure = ref<string | null>(null)
 const pending = ref<BucketHolderEntry | null>(null)
+const pendingRecovery = ref<Exclude<RecoveryAfter, 'kept'>>('unmet')
 const accepted = ref(false)
 
 const query = ref('')
@@ -73,6 +81,7 @@ async function removeHolder(entry: BucketHolderEntry, confirm: boolean) {
   failure.value = null
   try {
     const result = await remove(entry.user_id, confirm)
+    if (result === 'confirm' && pending.value !== entry) pendingRecovery.value = 'unmet'
     pending.value = result === 'confirm' ? entry : null
     accepted.value = false
   } catch (cause) {
@@ -83,10 +92,14 @@ async function removeHolder(entry: BucketHolderEntry, confirm: boolean) {
 }
 
 function startRemove(entry: BucketHolderEntry) {
-  if (breaksRecovery(list.value, entry.user_id)) {
-    accepted.value = false
-    pending.value = entry
-  } else void removeHolder(entry, false)
+  const after = holders.value ? recoveryAfter(holders.value, entry.user_id) : 'unknown'
+  if (after === 'kept') {
+    void removeHolder(entry, false)
+    return
+  }
+  accepted.value = false
+  pendingRecovery.value = after
+  pending.value = entry
 }
 </script>
 
@@ -102,6 +115,10 @@ function startRemove(entry: BucketHolderEntry) {
       <Notice v-else-if="state === 'failed'" tone="error" :title="error ?? undefined">The key holders are unknown.</Notice>
       <template v-else-if="holders">
         <p class="text-xs text-muted-foreground">{{ recovery.detail }}</p>
+        <Notice v-if="partial" tone="warning" data-partial>
+          {{ holders?.unresolved || 'Some' }} key {{ holders?.unresolved === 1 ? 'holder' : 'holders' }} could not be looked up,
+          so this list is partial.
+        </Notice>
         <ul class="divide-y divide-border text-sm">
           <li v-for="entry in list" :key="entry.user_id" class="flex flex-wrap items-center gap-2 py-2">
             <span class="min-w-0 flex-1 truncate" :title="entry.user_id">{{ nameOf(entry) }}</span>
@@ -155,13 +172,22 @@ function startRemove(entry: BucketHolderEntry) {
         <DialogHeader>
           <DialogTitle>Remove {{ pending ? nameOf(pending) : '' }}?</DialogTitle>
           <DialogDescription>
-            After this removal the bucket has fewer than two ready key holders and none with a recovery code. If the
-            last key is lost, the data in this bucket cannot be read again.
+            <template v-if="pendingRecovery === 'unmet'">
+              After this removal the recovery rule is not met: fewer than two ready key holders remain, and none has a
+              recovery code.
+            </template>
+            <template v-else>
+              After this removal the recovery rule cannot be verified: a remaining recovery code is unknown, or some key
+              holders could not be looked up.
+            </template>
+            If the remaining usable key is then lost too, the data in this bucket cannot be read again.
           </DialogDescription>
         </DialogHeader>
         <label class="flex items-start gap-2 text-xs text-muted-foreground">
           <input type="checkbox" class="mt-0.5" :checked="accepted" @click="accepted = !accepted" />
-          <span>I accept that recovery is no longer possible.</span>
+          <span>
+            {{ pendingRecovery === 'unmet' ? 'I accept that the recovery rule is not met.' : 'I accept that recovery cannot be verified.' }}
+          </span>
         </label>
         <DialogFooter>
           <Button variant="outline" size="sm" @click="pending = null">Cancel</Button>
diff --git a/src/composables/useBucketHolders.test.ts b/src/composables/useBucketHolders.test.ts
index 4f8847be..00294724 100644
--- a/src/composables/useBucketHolders.test.ts
+++ b/src/composables/useBucketHolders.test.ts
@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { effectScope, ref } from 'vue'
 import * as Api from '@/lib/api'
 import type { BucketEncryptionResponse, BucketHolderEntry, BucketHoldersResponse } from '@/lib/api'
-import { breaksRecovery, useBucketHolders } from './useBucketHolders'
+import { listedRecovery, recoveryAfter, useBucketHolders } from './useBucketHolders'
 
 const listBucketHolders = vi.fn()
 const removeBucketHolder = vi.fn()
@@ -28,7 +28,13 @@ function holder(userId: string, overrides: Partial<BucketHolderEntry> = {}): Buc
 }
 
 function listing(entries: BucketHolderEntry[], revision = 'rev-1'): BucketHoldersResponse {
-  return { holders: entries, recovery: { state: 'met', ready_holders: 2, ready_with_recovery: 0 }, revision }
+  return {
+    holders: entries,
+    complete: true,
+    unresolved: 0,
+    recovery: { state: 'met', ready_holders: 2, ready_with_recovery: 0 },
+    revision,
+  }
 }
 
 const NODE = { baseUrl: 'https://b.test/api/v1', token: 't' }
@@ -70,11 +76,24 @@ afterEach(() => {
 
 describe('bucket key holders', () => {
   it('foresees a removal that breaks recovery', () => {
-    expect(breaksRecovery([holder('A'), holder('B')], 'A')).toBe(true)
-    expect(breaksRecovery([holder('A'), holder('B'), holder('C')], 'A')).toBe(false)
-    expect(breaksRecovery([holder('A'), holder('B', { has_recovery: true })], 'A')).toBe(false)
-    expect(breaksRecovery([holder('A'), holder('B'), holder('C', { state: 'pending' })], 'A')).toBe(true)
-    expect(breaksRecovery([holder('A'), holder('B', { has_recovery: null })], 'A')).toBe(true)
+    const after = (entries: BucketHolderEntry[], complete = true) =>
+      recoveryAfter({ ...listing(entries), complete }, 'A')
+    expect(after([holder('A'), holder('B')])).toBe('unmet')
+    expect(after([holder('A'), holder('B'), holder('C')])).toBe('kept')
+    expect(after([holder('A'), holder('B', { has_recovery: true })])).toBe('kept')
+    expect(after([holder('A'), holder('B'), holder('C', { state: 'pending' })])).toBe('unmet')
+    expect(after([holder('A'), holder('B', { has_recovery: null })])).toBe('unknown')
+    expect(after([holder('A'), holder('B')], false)).toBe('unknown')
+    expect(after([holder('A'), holder('B'), holder('C')], false)).toBe('kept')
+  })
+
+  it('reads recovery from a partial list as unknown unless its resolved holders meet it', () => {
+    const degraded = { state: 'degraded' as const, ready_holders: 1, ready_with_recovery: 0 }
+    const partial = { ...listing([holder('A')]), complete: false, unresolved: 2 }
+
+    expect(listedRecovery({ ...partial, recovery: degraded }).state).toBe('unknown')
+    expect(listedRecovery(partial).state).toBe('met')
+    expect(listedRecovery({ ...listing([holder('A')]), recovery: degraded }).state).toBe('degraded')
   })
 
   it('drops a holder list that arrives after the bucket changed', async () => {
diff --git a/src/composables/useBucketHolders.ts b/src/composables/useBucketHolders.ts
index 425b11f4..4bed8ae9 100644
--- a/src/composables/useBucketHolders.ts
+++ b/src/composables/useBucketHolders.ts
@@ -13,6 +13,7 @@ import {
   type BucketEncryptionResponse,
   type BucketHolderEntry,
   type BucketHoldersResponse,
+  type RecoveryStatus,
 } from '@/lib/api'
 import { encryptionError } from '@/lib/bucketEncryption'
 
@@ -27,12 +28,22 @@ export interface HolderSource {
 
 export type HoldersState = 'loading' | 'ready' | 'refused' | 'failed'
 export type RemovalResult = 'removed' | 'confirm'
+/** `unknown`: a remaining recovery code is unknown, or the list is partial. */
+export type RecoveryAfter = 'kept' | 'unmet' | 'unknown'
 
-/** True when removing `userId` would leave fewer than two ready holders and no ready recovery code. */
-export function breaksRecovery(holders: BucketHolderEntry[], userId: string): boolean {
-  const remaining = holders.filter((holder) => holder.user_id !== userId && holder.state === 'ready')
+/** Whether two ready holders, or one with a recovery code, remain after removing `userId`. */
+export function recoveryAfter(response: BucketHoldersResponse, userId: string): RecoveryAfter {
+  const remaining = response.holders.filter((holder) => holder.user_id !== userId && holder.state === 'ready')
   const ready = new Set(remaining.map((holder) => holder.user_id))
-  return ready.size < 2 && !remaining.some((holder) => holder.has_recovery === true)
+  if (ready.size >= 2 || remaining.some((holder) => holder.has_recovery === true)) return 'kept'
+  const uncertain = response.complete !== true || remaining.some((holder) => holder.has_recovery === null)
+  return uncertain ? 'unknown' : 'unmet'
+}
+
+/** A partial list proves recovery only when its resolved holders already meet the rule. */
+export function listedRecovery(response: BucketHoldersResponse): RecoveryStatus {
+  if (response.complete === true || response.recovery.state === 'met') return response.recovery
+  return { ...response.recovery, state: 'unknown' }
 }
 
 export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index 26bffa75..834806ba 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -151,6 +151,10 @@ export interface BucketHolderEntry {
 
 export interface BucketHoldersResponse {
   holders: BucketHolderEntry[]
+  /** False when some holders could not be looked up; the list is then partial. */
+  complete: boolean
+  /** Holders whose key directory lookup failed. */
+  unresolved: number
   recovery: RecoveryStatus
   /** Opaque revision of the holder set; a removal names it so a changed set is refused. */
   revision: string

From 7c73b1cb0f90d0e92552f3d65bab3c7edd08ce18 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:02:04 +0200
Subject: [PATCH 30/86] fix: show a running or failed key holder search

---
 .../storage/BucketHoldersSection.test.ts      | 22 ++++++++++++--
 .../storage/BucketHoldersSection.vue          | 29 ++++++++++++++++---
 2 files changed, 45 insertions(+), 6 deletions(-)

diff --git a/src/components/storage/BucketHoldersSection.test.ts b/src/components/storage/BucketHoldersSection.test.ts
index 5a1493f7..b6f3c260 100644
--- a/src/components/storage/BucketHoldersSection.test.ts
+++ b/src/components/storage/BucketHoldersSection.test.ts
@@ -6,11 +6,12 @@ import * as Wording from '@/lib/bucketEncryption'
 import * as StateBadge from '@/lib/stateBadge'
 import * as Utils from '@/lib/utils'
 import { listedRecovery, recoveryAfter, type HoldersState } from '@/composables/useBucketHolders'
-import { button, click, compileClientComponent, content, element, mountApp, moduleDefault } from '@/test/clientRender'
+import { button, click, compileClientComponent, content, element, flush, mountApp, moduleDefault } from '@/test/clientRender'
 
 const holders = ref<BucketHoldersResponse | null>(null)
 const state = ref<HoldersState>('ready')
 const remove = vi.fn()
+const searchUsers = vi.fn()
 
 const Slotted = (tag: string) =>
   defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
@@ -33,7 +34,7 @@ const section = compileClientComponent(new URL('./BucketHoldersSection.vue', imp
   '@/components/ui/Input.vue': moduleDefault(Slotted('input')),
   '@/components/ui/Notice.vue': moduleDefault(Slotted('aside')),
   '@/components/ui/Spinner.vue': moduleDefault(defineComponent(() => () => h('span', 'loading'))),
-  '@/composables/useAruna': { useAruna: () => ({ searchUsers: async () => ({ users: [] }) }) },
+  '@/composables/useAruna': { useAruna: () => ({ searchUsers }) },
   '@/composables/useBucketHolders': {
     listedRecovery,
     recoveryAfter,
@@ -64,6 +65,7 @@ function rowButton(root: Awaited<ReturnType<typeof render>>, name: string) {
 beforeEach(() => {
   state.value = 'ready'
   remove.mockReset().mockResolvedValue('removed')
+  searchUsers.mockReset().mockResolvedValue({ users: [] })
 })
 
 describe('bucket key holder list', () => {
@@ -137,4 +139,20 @@ describe('bucket key holder list', () => {
     expect(content(root)).toContain('The key holders are unknown.')
     expect(content(root)).not.toContain('no key holders')
   })
+
+  it('shows a running and a failed user search instead of no match', async () => {
+    let fail!: (reason: unknown) => void
+    searchUsers.mockReturnValueOnce(new Promise((_, reject) => (fail = reject)))
+    const root = await render([holder('Ada')])
+    const search = element(root, (node) => node.tag === 'input' && node.props.id === 'holder-search')
+
+    ;(search.props['onUpdate:modelValue'] as (value: string) => void)('Bo')
+    await flush()
+    expect(content(root)).toContain('Searching…')
+    fail(new Error('The directory did not answer.'))
+    await flush()
+
+    expect(content(root)).toContain('The user search failed: The directory did not answer.')
+    expect(content(root)).not.toContain('No matching users.')
+  })
 })
diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index d435519f..55514d74 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -25,7 +25,7 @@ import {
 import type { BucketHolderEntry, UserSearchHit } from '@/lib/api'
 import { HOLDER_STATE_LABEL, ORIGIN_LABEL, encryptionError, recoverySummary } from '@/lib/bucketEncryption'
 import { stateVariant } from '@/lib/stateBadge'
-import { shortUserId } from '@/lib/utils'
+import { errorMessage, shortUserId } from '@/lib/utils'
 
 const props = defineProps<{ bucket: string; canManage: boolean; source: HolderSource }>()
 
@@ -44,16 +44,28 @@ const accepted = ref(false)
 const query = ref('')
 const results = ref<UserSearchHit[]>([])
 const chosen = ref<UserSearchHit | null>(null)
+const searchState = ref<'idle' | 'searching' | 'done' | 'failed'>('idle')
+const searchError = ref<string | null>(null)
 let searches = 0
 const runSearch = useDebounceFn(async (term: string, run: number) => {
   if (term.length < 2 || run !== searches) return
-  const response = await searchUsers(term).catch(() => ({ users: [] }))
-  if (run === searches) results.value = response.users.filter((hit) => !list.value.some((h) => h.user_id === hit.user_id))
+  try {
+    const response = await searchUsers(term)
+    if (run !== searches) return
+    results.value = response.users.filter((hit) => !list.value.some((holder) => holder.user_id === hit.user_id))
+    searchState.value = 'done'
+  } catch (cause) {
+    if (run !== searches) return
+    searchError.value = errorMessage(cause)
+    searchState.value = 'failed'
+  }
 }, 250)
 watch(query, (term) => {
   if (chosen.value && term === chosen.value.name) return
   chosen.value = null
   results.value = []
+  searchError.value = null
+  searchState.value = term.trim().length >= 2 ? 'searching' : 'idle'
   void runSearch(term.trim(), ++searches)
 })
 
@@ -149,7 +161,16 @@ function startRemove(entry: BucketHolderEntry) {
         <div class="relative flex gap-2">
           <Input id="holder-search" v-model="query" placeholder="Search users (min 2 characters)" />
           <Button size="sm" :disabled="!chosen || busy !== null" @click="addHolder">Grant</Button>
-          <div v-if="results.length && !chosen" class="absolute top-10 z-10 w-full rounded-md border border-border bg-popover shadow-md">
+          <div
+            v-if="searchState !== 'idle' && !chosen"
+            class="absolute top-10 z-10 w-full rounded-md border border-border bg-popover shadow-md"
+            data-search-results
+          >
+            <p v-if="searchState === 'searching'" class="px-3 py-2 text-xs text-muted-foreground">Searching…</p>
+            <p v-else-if="searchState === 'failed'" class="px-3 py-2 text-xs text-destructive">
+              The user search failed: {{ searchError }}
+            </p>
+            <p v-else-if="!results.length" class="px-3 py-2 text-xs text-muted-foreground">No matching users.</p>
             <button
               v-for="hit in results"
               :key="hit.user_id"

From 3c6cb15895bba92f39812e061cab2ce3bded1379 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:04:35 +0200
Subject: [PATCH 31/86] feat: wait for a bucket unlock in previews of locked
 content

---
 src/components/preview/PreviewBody.vue   | 20 ++++++
 src/composables/s3/errors.test.ts        | 19 +++++-
 src/composables/s3/errors.ts             | 17 +++++
 src/composables/s3/objects.ts            |  3 +-
 src/composables/useObjectPreview.test.ts | 85 ++++++++++++++++++++++++
 src/composables/useObjectPreview.ts      | 50 +++++++++++++-
 src/composables/useS3.ts                 |  1 +
 7 files changed, 191 insertions(+), 4 deletions(-)
 create mode 100644 src/composables/useObjectPreview.test.ts

diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 3c769fbd..6cccc762 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -170,6 +170,26 @@ async function download() {
       <Button variant="outline" size="sm" @click="download"><Download class="h-4 w-4" /> Download</Button>
     </Notice>
 
+    <Notice
+      v-else-if="preview.status.value === 'locked'"
+      tone="warning"
+      title="Waiting for a bucket unlock"
+      class="space-y-2 px-5 py-6"
+      data-preview-locked
+    >
+      <p>
+        This bucket is encrypted and locked, so its content cannot be shown. A key holder unlocks it on the
+        <RouterLink v-if="preview.lockedLink.value" :to="preview.lockedLink.value" class="font-medium underline">
+          Encryption tab of the bucket</RouterLink
+        >.
+      </p>
+      <p v-if="preview.lockCheck.value === 'still'">The bucket is still locked.</p>
+      <p v-else-if="preview.lockCheck.value === 'failed'">The lock state of the bucket could not be read.</p>
+      <Button variant="outline" size="sm" :disabled="preview.lockCheck.value === 'checking'" @click="preview.recheck()">
+        Check again
+      </Button>
+    </Notice>
+
     <ErrorPanel
       v-else-if="preview.status.value === 'error'"
       :message="preview.errorMessage.value ?? 'This object could not be previewed.'"
diff --git a/src/composables/s3/errors.test.ts b/src/composables/s3/errors.test.ts
index aa936f26..16763fe6 100644
--- a/src/composables/s3/errors.test.ts
+++ b/src/composables/s3/errors.test.ts
@@ -1,6 +1,23 @@
 import { describe, expect, it } from 'vitest'
 import { BUCKET_NAME_REQUIREMENT } from '@/lib/bucketName'
-import { isS3BucketMissingError, s3ErrorMessage, s3ErrorReport } from './errors'
+import { isS3BucketLockedError, isS3BucketMissingError, s3ErrorMessage, s3ErrorReport } from './errors'
+
+describe('locked bucket refusals', () => {
+  it('tells a locked bucket from an ordinary refusal only by the header', () => {
+    const sdkLocked = Object.defineProperty(
+      { name: 'AccessDenied', message: 'Bucket is locked', $metadata: { httpStatusCode: 403 } },
+      '$response',
+      { value: { headers: { 'x-aruna-bucket-locked': 'true' } }, enumerable: false },
+    )
+    const denied = { name: 'AccessDenied', message: 'Access Denied', $metadata: { httpStatusCode: 403 } }
+
+    expect(isS3BucketLockedError(sdkLocked)).toBe(true)
+    expect(isS3BucketLockedError({ bucketLocked: true })).toBe(true)
+    expect(isS3BucketLockedError(denied)).toBe(false)
+    expect(s3ErrorMessage(sdkLocked)).toContain('This bucket is locked.')
+    expect(s3ErrorMessage(denied)).toBe('This session is not allowed to do that.')
+  })
+})
 
 describe('s3 error messages', () => {
   it('never renders the SDK placeholder', () => {
diff --git a/src/composables/s3/errors.ts b/src/composables/s3/errors.ts
index 7cf0742a..cf384194 100644
--- a/src/composables/s3/errors.ts
+++ b/src/composables/s3/errors.ts
@@ -36,6 +36,22 @@ const CODE_SENTENCES: Record<string, string> = {
 
 const NODE_FAILURE_SENTENCE = 'The node could not complete the request.'
 
+/** Set only on a refusal because the bucket is locked; plain AccessDenied never carries it. */
+export const BUCKET_LOCKED_HEADER = 'x-aruna-bucket-locked'
+export const BUCKET_LOCKED_MESSAGE = 'This bucket is locked. A key holder must unlock it before its data can be read.'
+
+/** A 403 from a locked bucket: the fetch path marks it, the SDK keeps the response headers. */
+export function isS3BucketLockedError(err: unknown): boolean {
+  if (!err || typeof err !== 'object') return false
+  const error = err as {
+    bucketLocked?: boolean
+    $metadata?: { httpStatusCode?: number }
+    $response?: { headers?: Record<string, string | undefined> }
+  }
+  if (error.bucketLocked === true) return true
+  return error.$metadata?.httpStatusCode === 403 && error.$response?.headers?.[BUCKET_LOCKED_HEADER] === 'true'
+}
+
 /** A readable headline plus the technical line the node sent, when it has one. */
 export interface S3ErrorReport {
   message: string
@@ -52,6 +68,7 @@ function plain(message: string): S3ErrorReport {
  */
 export function s3ErrorReport(err: unknown, bucket?: string): S3ErrorReport {
   if (isS3PurgeInProgressError(err)) return plain(PURGE_IN_PROGRESS_MESSAGE)
+  if (isS3BucketLockedError(err)) return plain(BUCKET_LOCKED_MESSAGE)
   if (err instanceof S3SessionUnavailableError) return plain(err.message)
   if (!err || typeof err !== 'object') return plain(String(err))
   const error = err as {
diff --git a/src/composables/s3/objects.ts b/src/composables/s3/objects.ts
index 3bb26492..a58b56f8 100644
--- a/src/composables/s3/objects.ts
+++ b/src/composables/s3/objects.ts
@@ -29,7 +29,7 @@ import { drsDownloadHref, isDrsReference } from '@/lib/tes'
 import { useAruna } from '../useAruna'
 import { client } from './client'
 import { resolveObjectUrl } from './endpoints'
-import { isS3AuthError, isS3NetworkError, PURGE_IN_PROGRESS_MESSAGE } from './errors'
+import { BUCKET_LOCKED_HEADER, isS3AuthError, isS3NetworkError, PURGE_IN_PROGRESS_MESSAGE } from './errors'
 import { hasActiveKey, type S3SessionReference } from './session'
 
 export interface ObjectEntry {
@@ -848,6 +848,7 @@ async function fetchObject(
   if (!response.ok) {
     throw Object.assign(new Error(`The object could not be fetched (HTTP ${response.status}).`), {
       $metadata: { httpStatusCode: response.status },
+      bucketLocked: response.status === 403 && response.headers.get(BUCKET_LOCKED_HEADER) === 'true',
     })
   }
   return response
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
new file mode 100644
index 00000000..aee38119
--- /dev/null
+++ b/src/composables/useObjectPreview.test.ts
@@ -0,0 +1,85 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import * as Api from '@/lib/api'
+import type { BucketEncryptionResponse, BucketUnlockStatus } from '@/lib/api'
+import { useObjectPreview } from './useObjectPreview'
+
+const getObjectText = vi.fn()
+const getBucketEncryption = vi.fn()
+
+vi.mock('./useS3', () => ({
+  useS3: () => ({ getObjectText, downloadUrl: async () => 'https://b.test/presigned' }),
+  s3ErrorMessage: (error: unknown) => (error instanceof Error ? error.message : String(error)),
+}))
+vi.mock('./s3/endpoints', () => ({
+  localNodeId: () => 'node-a',
+  nodeApiBase: (id: string) => `https://${id}.test/api/v1`,
+}))
+vi.mock('@/lib/api', async (importOriginal) => ({
+  ...(await importOriginal<typeof Api>()),
+  getBucketEncryption: (...args: unknown[]) => getBucketEncryption(...args),
+}))
+
+const TARGET = { bucket: 'reef', key: 'notes.txt', nodeId: 'node-b' }
+const LOCKED = Object.assign(new Error('The object could not be fetched (HTTP 403).'), {
+  $metadata: { httpStatusCode: 403 },
+  bucketLocked: true,
+})
+
+function lockState(state: BucketUnlockStatus['state']): BucketEncryptionResponse {
+  const unlock = { state, lock_reason: null, locked_at_ms: null, session_id: null, unlocked_at_ms: null, deadline_ms: null, max_deadline_ms: null }
+  return {
+    mode: 'vault_locked',
+    generations: [{ generation: 2, role: 'active', public_key: 'PK', fingerprint: 'f', unlock }],
+  } as BucketEncryptionResponse
+}
+
+beforeEach(() => {
+  getObjectText.mockReset()
+  getBucketEncryption.mockReset()
+})
+
+describe('preview of a locked bucket', () => {
+  it('waits for a key and links to the Encryption tab on the bucket node', async () => {
+    getObjectText.mockRejectedValue(LOCKED)
+    const preview = useObjectPreview()
+
+    await preview.load(TARGET)
+
+    expect(preview.status.value).toBe('locked')
+    expect(preview.errorMessage.value).toBeNull()
+    expect(preview.lockedLink.value).toEqual({
+      name: 'bucket-storage',
+      params: { bucketId: 'reef' },
+      query: { tab: 'encryption', node: 'node-b' },
+    })
+  })
+
+  it('loads again only after the node reports an unlock', async () => {
+    getObjectText.mockRejectedValueOnce(LOCKED)
+    const preview = useObjectPreview()
+    await preview.load(TARGET)
+
+    getBucketEncryption.mockResolvedValueOnce(lockState('locked'))
+    await preview.recheck()
+    expect(preview.lockCheck.value).toBe('still')
+    expect(getObjectText).toHaveBeenCalledTimes(1)
+    expect(getBucketEncryption.mock.calls[0]).toEqual(['reef', { baseUrl: 'https://node-b.test/api/v1', token: expect.any(String) }])
+
+    getBucketEncryption.mockResolvedValueOnce(lockState('unlocked'))
+    getObjectText.mockResolvedValueOnce('plain text')
+    await preview.recheck()
+
+    expect(preview.status.value).toBe('ready')
+    expect(preview.text.value).toBe('plain text')
+  })
+
+  it('keeps an ordinary refusal an error', async () => {
+    getObjectText.mockRejectedValue(Object.assign(new Error('denied'), { $metadata: { httpStatusCode: 403 } }))
+    const preview = useObjectPreview()
+
+    await preview.load(TARGET)
+
+    expect(preview.status.value).toBe('error')
+    expect(preview.lockedLink.value).toBeNull()
+  })
+})
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 37694b95..b6e1fa33 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -1,6 +1,11 @@
-import { ref } from 'vue'
+import { computed, ref, shallowRef } from 'vue'
+import { getBucketEncryption } from '@/lib/api'
+import { bucketUnlockLink, keyGenerations } from '@/lib/bucketEncryption'
 import { formatBytes } from '@/lib/utils'
 import { hasReferenceMetadata } from '@/lib/references'
+import { authToken } from './aruna/state'
+import { isS3BucketLockedError } from './s3/errors'
+import { localNodeId, nodeApiBase } from './s3/endpoints'
 import { s3ErrorMessage, useS3 } from './useS3'
 
 export type PreviewKind = 'text' | 'markdown' | 'table' | 'image' | 'media' | 'pdf' | 'download'
@@ -106,7 +111,11 @@ function mediaSubtype(target: { key: string; contentType?: string }): MediaKind
 export function useObjectPreview() {
   const s3 = useS3()
 
-  const status = ref<'idle' | 'loading' | 'ready' | 'error'>('idle')
+  /** `locked`: the bucket is encrypted and locked, so the content waits for an unlock. */
+  const status = ref<'idle' | 'loading' | 'ready' | 'error' | 'locked'>('idle')
+  const lockCheck = ref<'idle' | 'checking' | 'still' | 'failed'>('idle')
+  const lockedTarget = shallowRef<PreviewTarget | null>(null)
+  let loadId = 0
   const kind = ref<PreviewKind>('download')
   const language = ref<string | undefined>(undefined)
   const mediaKind = ref<MediaKind>('video')
@@ -134,6 +143,9 @@ export function useObjectPreview() {
     corsBlocked.value = false
     sizeNote.value = null
     referenced.value = false
+    lockCheck.value = 'idle'
+    lockedTarget.value = null
+    ++loadId
     ++referenceProbeId
   }
 
@@ -166,6 +178,7 @@ export function useObjectPreview() {
 
   async function load(target: PreviewTarget) {
     reset()
+    const id = loadId
     status.value = 'loading'
     const classified = classifyObject(target)
     kind.value = classified.kind
@@ -203,6 +216,11 @@ export function useObjectPreview() {
       }
       status.value = 'ready'
     } catch (err) {
+      if (id === loadId && isS3BucketLockedError(err)) {
+        lockedTarget.value = target
+        status.value = 'locked'
+        return
+      }
       // A cross-origin fetch blocked by bucket CORS (or an offline node) rejects
       // with a TypeError and no response; anything else is a real read error.
       if (err instanceof TypeError) corsBlocked.value = true
@@ -216,8 +234,36 @@ export function useObjectPreview() {
     }
   }
 
+  const lockedLink = computed(() =>
+    status.value === 'locked' && lockedTarget.value
+      ? bucketUnlockLink(lockedTarget.value.bucket, lockedTarget.value.nodeId)
+      : null,
+  )
+
+  /** Reads the bucket's lock state on its node and loads again only after an observed unlock. */
+  async function recheck(): Promise<void> {
+    const target = lockedTarget.value
+    if (!target || status.value !== 'locked') return
+    const id = loadId
+    lockCheck.value = 'checking'
+    const node = target.nodeId ?? localNodeId()
+    const baseUrl = node ? nodeApiBase(node) : null
+    try {
+      if (!baseUrl) throw new Error('The node publishes no API address.')
+      const answer = await getBucketEncryption(target.bucket, { baseUrl, token: authToken.value })
+      if (id !== loadId) return
+      if (keyGenerations(answer).list.some((key) => key.unlock.state === 'unlocked')) await load(target)
+      else lockCheck.value = 'still'
+    } catch {
+      if (id === loadId) lockCheck.value = 'failed'
+    }
+  }
+
   return {
     status,
+    lockCheck,
+    lockedLink,
+    recheck,
     kind,
     language,
     mediaKind,
diff --git a/src/composables/useS3.ts b/src/composables/useS3.ts
index 353df2c4..131c206b 100644
--- a/src/composables/useS3.ts
+++ b/src/composables/useS3.ts
@@ -51,6 +51,7 @@ export {
   S3SessionUnavailableError,
   PURGE_IN_PROGRESS_MESSAGE,
   isS3AuthError,
+  isS3BucketLockedError,
   isS3BucketMissingError,
   isS3BucketNotEmptyError,
   isS3NetworkError,

From 617c8b6c6adf394adaa9f7621431a235fa14d077 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:05:49 +0200
Subject: [PATCH 32/86] fix: show a compute run that waits for a bucket key

---
 src/components/compute/TaskDetailPanel.vue    |  6 +++++
 .../jobs/JobDistributedDetail.test.ts         | 25 +++++++++++++++++++
 src/test/tutorialCompute.ts                   |  1 +
 3 files changed, 32 insertions(+)

diff --git a/src/components/compute/TaskDetailPanel.vue b/src/components/compute/TaskDetailPanel.vue
index ff959a0d..1e64981a 100644
--- a/src/components/compute/TaskDetailPanel.vue
+++ b/src/components/compute/TaskDetailPanel.vue
@@ -17,6 +17,7 @@ import CountedList from '@/components/ui/CountedList.vue'
 import Pagination from '@/components/ui/Pagination.vue'
 import DocsLink from '@/components/ui/DocsLink.vue'
 import JobExecutionsTable from '@/components/jobs/JobExecutionsTable.vue'
+import JobKeyWait from '@/components/jobs/JobKeyWait.vue'
 import JobPlacementFigure from '@/components/jobs/JobPlacementFigure.vue'
 import RunLogDialog, { type LogStream } from '@/components/compute/RunLogDialog.vue'
 import TaskHeader from '@/components/compute/TaskHeader.vue'
@@ -299,9 +300,13 @@ interface Summary {
   tone: 'error' | 'warning' | 'info' | 'success'
   headline: string
 }
+// TES has no state for a run that waits for a locked bucket; the native job says so.
+const awaitingKey = computed(() => nativeJob.value?.state === 'awaiting_key' && !isTerminalTesState(task.value?.state))
+
 const summary = computed<Summary | null>(() => {
   const state = task.value?.state
   if (!state) return null
+  if (awaitingKey.value) return { tone: 'warning', headline: 'Waiting for a bucket unlock' }
   const duration = runDuration.value
   const where = executorKind.value ? ` on ${executorKind.value}` : ''
   switch (state) {
@@ -667,6 +672,7 @@ async function confirmDelete() {
             <DocsLink topic="compute-run" section="Follow the run" />
           </p>
         </Notice>
+        <JobKeyWait v-if="awaitingKey" :waits="nativeJob?.awaiting_keys ?? []" />
         <p v-if="lastPollError" class="text-[11px] text-muted-foreground">Refresh failed, retrying.</p>
 
         <section class="space-y-3">
diff --git a/src/components/jobs/JobDistributedDetail.test.ts b/src/components/jobs/JobDistributedDetail.test.ts
index fba09901..35ef42c1 100644
--- a/src/components/jobs/JobDistributedDetail.test.ts
+++ b/src/components/jobs/JobDistributedDetail.test.ts
@@ -275,6 +275,9 @@ function taskPanel(getTask: unknown, getJob: unknown, deleteJob: unknown = vi.fn
     '@/components/ui/Pagination.vue': moduleDefault(PaginationStub),
     '@/components/jobs/JobPlacementFigure.vue': moduleDefault(PlacementFigureStub),
     '@/components/jobs/JobExecutionsTable.vue': moduleDefault(ExecutionsTableStub),
+    '@/components/jobs/JobKeyWait.vue': moduleDefault(
+      defineComponent({ props: { waits: Array }, setup: (props) => () => h('aside', `waits for ${JSON.stringify(props.waits)}`) }),
+    ),
     '@/components/compute/RunLogDialog.vue': moduleDefault(PassThroughStub),
     '@/components/compute/TaskHeader.vue': moduleDefault(PassThroughStub),
     '@/components/assistant/AskAiButton.vue': moduleDefault(PassThroughStub),
@@ -902,6 +905,28 @@ describe('distributed job detail components', () => {
     mounted.app.unmount()
   })
 
+  it('says a queued run waits for a bucket unlock when its native job does', async () => {
+    const getTask = vi.fn(async () => ({
+      id: 'waiting-run',
+      state: 'QUEUED',
+      executors: [{ image: 'alpine', command: ['sh'] }],
+      inputs: [],
+      outputs: [],
+      logs: [],
+      tags: {},
+    }))
+    const waits = [{ node_id: 'node-b', bucket: 'reef' }]
+    const getJob = vi.fn(async () => ({ state: 'awaiting_key', awaiting_keys: waits, family: null }))
+
+    const mounted = await mount(taskPanel(getTask, getJob), { taskId: 'waiting-run', open: true })
+    await vi.waitFor(() => expect(content(mounted.root)).toContain('Waiting for a bucket unlock'))
+
+    expect(mounted.errors).toEqual([])
+    expect(content(mounted.root)).toContain(`waits for ${JSON.stringify(waits)}`)
+    expect(content(mounted.root)).not.toContain('Queued, waiting for a node')
+    mounted.app.unmount()
+  })
+
   it('tells a failure once, with its cause', async () => {
     // The badge says Failed; only the stage and the cause line say what failed.
     const getTask = vi.fn(async () => ({
diff --git a/src/test/tutorialCompute.ts b/src/test/tutorialCompute.ts
index 6fc0c5fa..70965436 100644
--- a/src/test/tutorialCompute.ts
+++ b/src/test/tutorialCompute.ts
@@ -305,6 +305,7 @@ const TaskDetailPanel = compileClientComponent(url('components/compute/TaskDetai
   '@/components/ui/Pagination.vue': moduleDefault(GenericStub),
   '@/components/jobs/JobPlacementFigure.vue': moduleDefault(GenericStub),
   '@/components/jobs/JobExecutionsTable.vue': moduleDefault(GenericStub),
+  '@/components/jobs/JobKeyWait.vue': moduleDefault(GenericStub),
   '@/components/compute/RunLogDialog.vue': moduleDefault(GenericStub),
   '@/components/compute/TaskHeader.vue': moduleDefault(TaskHeaderStub),
   '@/components/assistant/AskAiButton.vue': moduleDefault(GenericStub),

From 30ae55c23d11db76909cc42174fd86ed3459000d Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:06:41 +0200
Subject: [PATCH 33/86] test: check IndexedDB and a decrypting bucket in the
 unlock flow

---
 .../useBucketEncryption.flow.test.ts          | 116 +++++++++++++++---
 1 file changed, 100 insertions(+), 16 deletions(-)

diff --git a/src/composables/useBucketEncryption.flow.test.ts b/src/composables/useBucketEncryption.flow.test.ts
index e75f793d..fb5a6ce9 100644
--- a/src/composables/useBucketEncryption.flow.test.ts
+++ b/src/composables/useBucketEncryption.flow.test.ts
@@ -28,32 +28,86 @@ async function retiredVault(): Promise<string> {
   return JSON.stringify({ ...created.payload, keys: [{ ...entry, retired_at: '2026-10-02T00:00:00Z' }] })
 }
 
+/** Enough of IndexedDB for the vault key store; every value it is given is recorded. */
+function fakeIndexedDb(writes: unknown[]) {
+  const stores = new Map<string, Map<unknown, unknown>>()
+  const answer = <T>(value: () => T) => {
+    const request: { result?: T; onsuccess?: () => void; onerror?: () => void } = {}
+    queueMicrotask(() => {
+      request.result = value()
+      request.onsuccess?.()
+    })
+    return request
+  }
+  const database = {
+    objectStoreNames: { contains: (name: string) => stores.has(name) },
+    createObjectStore: (name: string) => stores.set(name, new Map()),
+    transaction: (name: string) => ({
+      objectStore: () => {
+        const store = stores.get(name)!
+        return {
+          get: (key: unknown) => answer(() => store.get(key)),
+          put: (value: unknown, key: unknown) => {
+            writes.push(value)
+            return answer(() => store.set(key, value))
+          },
+          delete: (key: unknown) => answer(() => store.delete(key)),
+          clear: () => answer(() => store.clear()),
+        }
+      },
+    }),
+    close() {},
+  }
+  return {
+    open: () => {
+      const request: { result?: unknown; onupgradeneeded?: () => void; onsuccess?: () => void } = {}
+      queueMicrotask(() => {
+        request.result = database
+        request.onupgradeneeded?.()
+        request.onsuccess?.()
+      })
+      return request
+    },
+  }
+}
+
 interface NodeCall {
   method: string
   url: URL
   key?: string
 }
 
-async function fakeNodes() {
+async function fakeNodes(options: { decrypting?: boolean } = {}) {
   const calls: NodeCall[] = []
   const stored: string[] = []
+  const idbWrites: unknown[] = []
   const directory = [{ record_id: 'R1', key_id: KEY_ID, public_key: base64(copy.recipient_public), fingerprint: '', has_recovery: true, created_at: '' }]
   let heads = [{ revision: 'R0001', predecessors: [], payload: await retiredVault(), updated_at: '' }]
   let unlocked = false
+  const unlockState = () =>
+    unlocked
+      ? { state: 'unlocked', lock_reason: null, locked_at_ms: null, session_id: 'S1', unlocked_at_ms: 2, deadline_ms: 3_600_002, max_deadline_ms: null }
+      : { state: 'locked', lock_reason: 'restart', locked_at_ms: 1, session_id: null, unlocked_at_ms: null, deadline_ms: null, max_deadline_ms: null }
+  const vectorKey = () => ({
+    generation: copy.generation,
+    role: options.decrypting ? 'source' : 'active',
+    public_key: base64(copy.bucket_public),
+    fingerprint: copy.bucket_fingerprint,
+    unlock: unlockState(),
+  })
   const status = () => ({
     bucket: 'reef',
-    mode: 'vault_locked',
+    mode: options.decrypting ? 'off' : 'vault_locked',
     bucket_id: copy.bucket_id,
     storage_generation: 1,
-    key_generation: copy.generation,
-    public_key: base64(copy.bucket_public),
-    fingerprint: copy.bucket_fingerprint,
+    key_generation: options.decrypting ? copy.generation + 1 : copy.generation,
+    public_key: options.decrypting ? null : base64(copy.bucket_public),
+    fingerprint: options.decrypting ? null : copy.bucket_fingerprint,
     cipher: 'chacha20_poly1305',
     block_keys: 'content_derived',
     max_unlock_ms: null,
-    unlock: unlocked
-      ? { state: 'unlocked', lock_reason: null, locked_at_ms: null, session_id: 'S1', unlocked_at_ms: 2, deadline_ms: 3_600_002, max_deadline_ms: null }
-      : { state: 'locked', lock_reason: 'restart', locked_at_ms: 1, session_id: null, unlocked_at_ms: null, deadline_ms: null, max_deadline_ms: null },
+    unlock: options.decrypting ? null : unlockState(),
+    generations: [vectorKey()],
     holders: { ready: 1, pending: 0, missing_key: 0 },
     recovery: { state: 'met', ready_holders: 1, ready_with_recovery: 1 },
     transition: null,
@@ -70,6 +124,7 @@ async function fakeNodes() {
   }
   vi.stubGlobal('window', { location: { origin: 'https://portal.test' } })
   vi.stubGlobal('localStorage', { getItem: () => null, setItem: (_: string, value: string) => stored.push(value) })
+  vi.stubGlobal('indexedDB', fakeIndexedDb(idbWrites))
   vi.stubGlobal('fetch', vi.fn(async (input: URL, init: RequestInit) => {
     const url = new URL(String(input))
     const method = init.method ?? 'GET'
@@ -94,11 +149,26 @@ async function fakeNodes() {
     if (path.endsWith('/copies/me')) return json({ copies: [sealedCopy] })
     if (path.endsWith('/unlock')) {
       unlocked = true
-      return json(status().unlock)
+      return json(unlockState())
     }
     return new Response('{}', { status: 404 })
   }))
-  return { calls, stored }
+  return { calls, stored, idbWrites }
+}
+
+/** Nothing this browser keeps, in storage or IndexedDB, holds the bucket key in any encoding. */
+function expectNoStoredKey(stored: string[], idbWrites: unknown[]) {
+  expect(idbWrites.length).toBeGreaterThan(0)
+  for (const value of [...stored, ...idbWrites]) {
+    if (value instanceof CryptoKey) {
+      expect(value.extractable).toBe(false)
+      expect(value.algorithm.name).toBe('AES-GCM')
+      continue
+    }
+    const text = JSON.stringify(value)
+    expect(text).not.toContain(copy.bucket_private)
+    expect(text).not.toContain(base64(copy.bucket_private))
+  }
 }
 
 async function signIn() {
@@ -122,7 +192,7 @@ afterEach(() => {
 
 describe('unlocking a vault-locked bucket from the browser', () => {
   it('opens the copy with a retired vault key and sends only that bucket key to its node', async () => {
-    const { calls, stored } = await fakeNodes()
+    const { calls, stored, idbWrites } = await fakeNodes()
     const { vault: keys, useBucketEncryption } = await signIn()
     await keys.load()
     await keys.unlock(PASSPHRASE)
@@ -146,11 +216,25 @@ describe('unlocking a vault-locked bucket from the browser', () => {
     const fetched = calls.findIndex((call) => call.url.pathname.endsWith('/copies/me'))
     expect(published).toBeGreaterThanOrEqual(0)
     expect(published).toBeLessThan(fetched)
-    // Nothing the browser stored holds the bucket key in any encoding.
-    for (const value of stored) {
-      expect(value).not.toContain(copy.bucket_private)
-      expect(value).not.toContain(base64(copy.bucket_private))
-    }
+    expectNoStoredKey(stored, idbWrites)
+  })
+
+  it('unlocks the previous key of a bucket whose stored versions are being decrypted', async () => {
+    const { calls, stored, idbWrites } = await fakeNodes({ decrypting: true })
+    const { vault: keys, useBucketEncryption } = await signIn()
+    await keys.load()
+    await keys.unlock(PASSPHRASE)
+    const encryption = scope.run(() => useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1')))!
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+
+    const outcome = await encryption.unlock(copy.generation)
+
+    expect(outcome).toMatchObject({ kind: 'unlocked' })
+    const unlock = calls.find((call) => call.url.pathname.endsWith('/unlock'))!
+    expect(unlock.key).toBe(copy.bucket_private)
+    expect(unlock.url.searchParams.get('generation')).toBe(String(copy.generation))
+    expect(encryption.status.value?.generations?.[0].unlock.state).toBe('unlocked')
+    expectNoStoredKey(stored, idbWrites)
   })
 
   it('sends nothing for a bucket shown under another session', async () => {

From 5cb18f74a654c3df6c8bd2832002e2c4d537f009 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:06:59 +0200
Subject: [PATCH 34/86] fix: document previous bucket keys and locked previews

---
 src/docs/v1.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/docs/v1.ts b/src/docs/v1.ts
index 77abfad3..ced851ad 100644
--- a/src/docs/v1.ts
+++ b/src/docs/v1.ts
@@ -809,7 +809,7 @@ export const docsTopics: DocsTopic[] = [
           'Vault-locked: only key holders unlock the bucket, and a node restart locks it again.',
         ],
         paragraphs: [
-          'Writes, listing and HEAD work while a bucket is locked. Downloads, previews and jobs that need its content wait for an unlock. The content hash stays visible in metadata, so equal files are still recognisable.',
+          'Writes, listing and HEAD work while a bucket is locked. Downloads, previews and jobs that need its content wait for an unlock; a preview links to the Encryption tab and loads again once the bucket is unlocked. The content hash stays visible in metadata, so equal files are still recognisable.',
           'S3 clients see an encrypted bucket like SSE-S3 (`x-amz-server-side-encryption: AES256`) and send no key.',
         ],
       },
@@ -843,7 +843,8 @@ export const docsTopics: DocsTopic[] = [
         paragraphs: [
           'Group admins change the mode, the cipher, the block keys and the longest unlock on the same tab. Open uploads must finish first.',
           'Turning encryption on needs no unlock: stored versions are encrypted in the background. Turning it off, changing the format, switching between modes and rotating the key need the bucket unlocked.',
-          'The tab shows the progress of the rewrite. It is complete only after the old copies are removed.',
+          'The tab shows the progress of the rewrite. It is complete only when no version is left or failed and the old copies are removed.',
+          'While stored versions are rewritten, the tab also lists the previous key with its fingerprint. Key holders unlock it the same way, also after encryption was turned off for new writes.',
           'Rotation grants every stored version to a new key without rewriting the data. It does not invalidate an old backup that still holds the old key.',
         ],
       },

From 2d17ebfe7af060f2cc8ddc08ed2faa540d0c0404 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:25:05 +0200
Subject: [PATCH 35/86] fix: name the key generation when extending an unlock

---
 src/composables/useBucketEncryption.test.ts | 20 ++++++++++++++++++++
 src/composables/useBucketEncryption.ts      |  3 ++-
 src/lib/api/bucketEncryption.test.ts        |  4 ++--
 src/lib/api/bucketEncryption.ts             |  2 ++
 4 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
index 72fddc4d..7b19bef1 100644
--- a/src/composables/useBucketEncryption.test.ts
+++ b/src/composables/useBucketEncryption.test.ts
@@ -7,6 +7,7 @@ import { useBucketEncryption } from './useBucketEncryption'
 const getBucketEncryption = vi.fn()
 const getBucketCompression = vi.fn()
 const lockBucket = vi.fn()
+const extendUnlock = vi.fn()
 const unlockWithVault = vi.fn()
 
 vi.mock('@/lib/api', async (importOriginal) => ({
@@ -14,6 +15,7 @@ vi.mock('@/lib/api', async (importOriginal) => ({
   getBucketEncryption: (...args: unknown[]) => getBucketEncryption(...args),
   getBucketCompression: (...args: unknown[]) => getBucketCompression(...args),
   lockBucket: (...args: unknown[]) => lockBucket(...args),
+  extendUnlock: (...args: unknown[]) => extendUnlock(...args),
 }))
 vi.mock('@/lib/vault/bucketUnlock', () => ({ unlockWithVault: (...args: unknown[]) => unlockWithVault(...args) }))
 vi.mock('./useUserVault', () => ({ useUserVault: () => ({ name: 'vault' }) }))
@@ -43,6 +45,16 @@ function status(overrides: Partial<Api.BucketEncryptionResponse> = {}): Api.Buck
   }
 }
 
+const OPEN: Api.BucketUnlockStatus = {
+  state: 'unlocked',
+  lock_reason: null,
+  locked_at_ms: null,
+  session_id: 'S1',
+  unlocked_at_ms: 1,
+  deadline_ms: null,
+  max_deadline_ms: null,
+}
+
 function deferred<T>() {
   let resolve!: (value: T) => void
   let reject!: (reason: unknown) => void
@@ -72,6 +84,7 @@ beforeEach(() => {
   getBucketEncryption.mockReset().mockResolvedValue(status())
   getBucketCompression.mockReset().mockResolvedValue({ bucket: 'reef', mode: 'zstd', level: 3, effective_level: 4 })
   lockBucket.mockReset()
+  extendUnlock.mockReset()
   unlockWithVault.mockReset()
   authToken.value = 'bearer-1'
   userInfo.value = { user: { user_id: 'u-1' }, realm: { realm_id: 'r-1' } } as never
@@ -222,6 +235,13 @@ describe('bucket encryption state', () => {
     expect(target.publicKey).toBe('PK1')
     expect(target.context).toMatchObject({ bucketId: 'B1', generation: 1 })
     await expect(encryption.extend(1)).rejects.toThrow('not unlocked')
+    getBucketEncryption.mockResolvedValue(
+      status({ mode: 'off', public_key: null, fingerprint: null, unlock: null, generations: [{ ...source, unlock: OPEN }] }),
+    )
+    await encryption.load()
+    extendUnlock.mockResolvedValue(OPEN)
+    await encryption.extend(1, 60_000)
+    expect(extendUnlock.mock.calls[0].slice(0, 2)).toEqual(['reef', { generation: 1, session_id: 'S1', duration_ms: 60_000 }])
   })
 
   it('stops the unlock when the bucket key changes under it', async () => {
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index eb615daa..92ef9902 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -160,7 +160,8 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
   function extend(keyGeneration: number, durationMs?: number) {
     const session = keyOf(keyGeneration)?.unlock.session_id
     if (!session) return Promise.reject(new Error('This key is not unlocked.'))
-    return run('extend', () => extendUnlock(scope.value.bucket, { session_id: session, duration_ms: durationMs }, client()))
+    const request = { generation: keyGeneration, session_id: session, duration_ms: durationMs }
+    return run('extend', () => extendUnlock(scope.value.bucket, request, client()))
   }
 
   function lock() {
diff --git a/src/lib/api/bucketEncryption.test.ts b/src/lib/api/bucketEncryption.test.ts
index a50f7504..073f465b 100644
--- a/src/lib/api/bucketEncryption.test.ts
+++ b/src/lib/api/bucketEncryption.test.ts
@@ -69,11 +69,11 @@ describe('bucket encryption client', () => {
   it('names the session to extend and locks without a body', async () => {
     const calls = stubFetch(UNLOCKED)
 
-    await extendUnlock('reef', { session_id: 'S1', duration_ms: 5_000 }, NODE)
+    await extendUnlock('reef', { generation: 2, session_id: 'S1', duration_ms: 5_000 }, NODE)
     await lockBucket('reef', NODE)
 
     expect(calls[0].url.pathname).toBe('/api/v1/data/buckets/reef/storage/encryption/extend')
-    expect(JSON.parse(String(calls[0].body))).toEqual({ session_id: 'S1', duration_ms: 5_000 })
+    expect(JSON.parse(String(calls[0].body))).toEqual({ generation: 2, session_id: 'S1', duration_ms: 5_000 })
     expect(calls[1].url.pathname).toBe('/api/v1/data/buckets/reef/storage/encryption/lock')
     expect(calls[1].body).toBeUndefined()
   })
diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index 834806ba..300bacf5 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -129,6 +129,8 @@ export interface UnlockBucketRequest {
 }
 
 export interface ExtendUnlockRequest {
+  /** The key generation whose unlock session is extended. */
+  generation: number
   session_id: string
   /** Measured from now; absent means the bucket maximum, or until lock or restart. */
   duration_ms?: number

From 181ca92f2a17b59e9b45d56125f1000cb6ee0b0e Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:25:43 +0200
Subject: [PATCH 36/86] fix: drop an action of an older bucket context after
 its final refresh

---
 src/composables/useBucketEncryption.test.ts | 24 +++++++++++++++++++++
 src/composables/useBucketEncryption.ts      | 22 +++++++++----------
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
index 7b19bef1..9ba77ac1 100644
--- a/src/composables/useBucketEncryption.test.ts
+++ b/src/composables/useBucketEncryption.test.ts
@@ -244,6 +244,30 @@ describe('bucket encryption state', () => {
     expect(extendUnlock.mock.calls[0].slice(0, 2)).toEqual(['reef', { generation: 1, session_id: 'S1', duration_ms: 60_000 }])
   })
 
+  it('leaves the busy flag and result of a newer context alone when an old refresh ends', async () => {
+    const { encryption, bucket } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    const refresh = deferred<Api.BucketEncryptionResponse>()
+    lockBucket.mockResolvedValueOnce(OPEN)
+    getBucketEncryption.mockReturnValueOnce(refresh.promise)
+
+    const first = encryption.lock()
+    await vi.waitFor(() => expect(getBucketEncryption).toHaveBeenCalledTimes(2))
+    bucket.value = 'other'
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    const second = deferred<unknown>()
+    lockBucket.mockReturnValueOnce(second.promise)
+    const next = encryption.lock()
+    expect(encryption.busy.value).toBe('lock')
+    refresh.resolve(status())
+
+    expect(await first).toBeNull()
+    expect(encryption.busy.value).toBe('lock')
+    second.resolve(OPEN)
+    expect(await next).toEqual(OPEN)
+    expect(encryption.busy.value).toBeNull()
+  })
+
   it('stops the unlock when the bucket key changes under it', async () => {
     const { encryption } = setup()
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index 92ef9902..c89c41a7 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -108,20 +108,20 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     if (busy.value) throw new Error('Another change to this bucket is still running.')
     const bound = binder()
     busy.value = action
+    let outcome: { done: true; value: T } | { done: false; cause: unknown }
     try {
-      const result = await work(bound)
-      return bound() ? result : null
+      outcome = { done: true, value: await work(bound) }
     } catch (cause) {
-      // A failure of a request from an older context is as stale as its success.
-      if (!bound()) return null
-      throw cause
-    } finally {
-      // The status is read again before any outcome is shown, also after a failure.
-      if (bound()) {
-        await load()
-        busy.value = null
-      }
+      outcome = { done: false, cause }
     }
+    // The status is read again before any outcome is shown, also after a failure. A request
+    // from an older context delivers nothing and leaves the busy flag of the new one alone.
+    if (!bound()) return null
+    await load()
+    if (!bound()) return null
+    busy.value = null
+    if (!outcome.done) throw outcome.cause
+    return outcome.value
   }
 
   /** The generation as the current status lists it, active or source. */

From 803c51f08a265a681cee9cb0f05ec95fea33c106 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:26:53 +0200
Subject: [PATCH 37/86] fix: keep the last bucket state and its drafts through
 a failed read

---
 .../storage/BucketEncryptionTab.test.ts       | 15 ++++++++++++-
 .../storage/BucketEncryptionTab.vue           | 17 ++++++++++++---
 .../storage/BucketHoldersSection.vue          |  9 ++++----
 src/composables/useBucketEncryption.test.ts   | 17 +++++++++++++++
 src/composables/useBucketEncryption.ts        | 21 ++++++++++++++-----
 5 files changed, 66 insertions(+), 13 deletions(-)

diff --git a/src/components/storage/BucketEncryptionTab.test.ts b/src/components/storage/BucketEncryptionTab.test.ts
index dfd9f23d..8877642f 100644
--- a/src/components/storage/BucketEncryptionTab.test.ts
+++ b/src/components/storage/BucketEncryptionTab.test.ts
@@ -35,7 +35,9 @@ const load = vi.fn()
 const tab = compileClientComponent(new URL('./BucketEncryptionTab.vue', import.meta.url), {
   vue: VueRuntime,
   '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
-  '@/components/storage/BucketEncryptionSettings.vue': moduleDefault(defineComponent(() => () => h('section', 'mode settings'))),
+  '@/components/storage/BucketEncryptionSettings.vue': moduleDefault(
+    defineComponent({ props: { busy: Boolean }, setup: (props) => () => h('section', `mode settings, busy ${props.busy}`) }),
+  ),
   '@/components/storage/BucketHoldersSection.vue': moduleDefault(defineComponent(() => () => h('section', 'holder list'))),
   '@/components/storage/BucketKeyAccess.vue': moduleDefault(KeyAccessStub),
   '@/components/ui/Badge.vue': moduleDefault(Slotted('span')),
@@ -127,6 +129,17 @@ describe('bucket encryption tab', () => {
     expect(load).toHaveBeenCalledOnce()
   })
 
+  it('keeps the settings draft owner mounted and holds back changes while the state is out of date', async () => {
+    const admin = { holder: true, ready_copy: true, admin: true }
+    const text = await render('stale', encrypted({ caller: admin }))
+
+    expect(text).toContain('This state may be out of date')
+    expect(text).toContain('The node did not answer.')
+    expect(text).toContain('Unknown')
+    expect(text).not.toContain('Locked since restart')
+    expect(text).toContain('mode settings, busy true')
+  })
+
   it('shows the lock state, key, format and recovery of a vault-locked bucket', async () => {
     const text = await render('ready', encrypted())
 
diff --git a/src/components/storage/BucketEncryptionTab.vue b/src/components/storage/BucketEncryptionTab.vue
index d5b11c75..9530bb06 100644
--- a/src/components/storage/BucketEncryptionTab.vue
+++ b/src/components/storage/BucketEncryptionTab.vue
@@ -34,7 +34,12 @@ const encryption = useBucketEncryption(toRef(props, 'bucket'), toRef(props, 'nod
 const { status, compression, state, error, refreshing, busy, outcomeUnknown } = encryption
 
 const encrypted = computed(() => Boolean(status.value && status.value.mode !== 'off'))
-const lock = computed(() => (status.value ? lockView(status.value) : null))
+const stale = computed(() => state.value === 'stale')
+const lock = computed(() => {
+  if (!status.value) return null
+  if (stale.value) return { label: 'Unknown', detail: 'The last read failed, so the lock state is not known right now.' }
+  return lockView(status.value)
+})
 const recovery = computed(() => recoverySummary(status.value?.recovery ?? null))
 const transition = computed(() => (status.value?.transition ? transitionView(status.value.transition) : null))
 
@@ -98,6 +103,11 @@ const WARNINGS = [
     </Notice>
 
     <template v-else-if="status">
+      <Notice v-if="stale" tone="warning" title="This state may be out of date" data-stale>
+        The node did not answer the last read: {{ error }}. Below is what it reported before. Changes wait until it
+        answers again.
+        <RefreshButton class="mt-2" label="Read the state again" :busy="refreshing" @click="encryption.load()" />
+      </Notice>
       <section class="surface">
         <header class="flex flex-wrap items-center gap-2 border-b border-border px-5 py-4">
           <KeyRound class="size-4 text-primary" />
@@ -138,7 +148,7 @@ const WARNINGS = [
         v-if="keyCount"
         :bucket="bucket"
         :status="status"
-        :busy="Boolean(busy)"
+        :busy="Boolean(busy) || stale"
         :outcome-unknown="outcomeUnknown"
         :unlock="encryption.unlock"
         :extend="encryption.extend"
@@ -149,13 +159,14 @@ const WARNINGS = [
         v-if="(encrypted || keyCount) && (caller?.holder || caller?.admin)"
         :bucket="bucket"
         :can-manage="Boolean(caller?.admin)"
+        :frozen="stale"
         :source="encryption"
       />
 
       <BucketEncryptionSettings
         v-if="caller?.admin"
         :status="status"
-        :busy="Boolean(busy)"
+        :busy="Boolean(busy) || stale"
         :save="encryption.save"
         :rotate="encryption.rotate"
       />
diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index 55514d74..df6fd6f1 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -27,7 +27,8 @@ import { HOLDER_STATE_LABEL, ORIGIN_LABEL, encryptionError, recoverySummary } fr
 import { stateVariant } from '@/lib/stateBadge'
 import { errorMessage, shortUserId } from '@/lib/utils'
 
-const props = defineProps<{ bucket: string; canManage: boolean; source: HolderSource }>()
+/** `frozen`: the bucket state is out of date, so no change is sent. */
+const props = defineProps<{ bucket: string; canManage: boolean; frozen?: boolean; source: HolderSource }>()
 
 const { searchUsers } = useAruna()
 const { holders, state, error, grant, remove } = useBucketHolders(props.source, toRef(props, 'bucket'))
@@ -145,7 +146,7 @@ function startRemove(entry: BucketHolderEntry) {
               v-if="canManage && entry.origin === 'explicit'"
               size="sm"
               variant="outline"
-              :disabled="busy !== null"
+              :disabled="busy !== null || frozen"
               @click="startRemove(entry)"
             >
               Remove
@@ -160,7 +161,7 @@ function startRemove(entry: BucketHolderEntry) {
         <label class="text-xs font-medium text-foreground" for="holder-search">Grant a key holder</label>
         <div class="relative flex gap-2">
           <Input id="holder-search" v-model="query" placeholder="Search users (min 2 characters)" />
-          <Button size="sm" :disabled="!chosen || busy !== null" @click="addHolder">Grant</Button>
+          <Button size="sm" :disabled="!chosen || busy !== null || frozen" @click="addHolder">Grant</Button>
           <div
             v-if="searchState !== 'idle' && !chosen"
             class="absolute top-10 z-10 w-full rounded-md border border-border bg-popover shadow-md"
@@ -215,7 +216,7 @@ function startRemove(entry: BucketHolderEntry) {
           <Button
             variant="destructive"
             size="sm"
-            :disabled="!accepted || busy !== null"
+            :disabled="!accepted || busy !== null || frozen"
             @click="pending && removeHolder(pending, true)"
           >
             Remove anyway
diff --git a/src/composables/useBucketEncryption.test.ts b/src/composables/useBucketEncryption.test.ts
index 9ba77ac1..8e2a840f 100644
--- a/src/composables/useBucketEncryption.test.ts
+++ b/src/composables/useBucketEncryption.test.ts
@@ -127,6 +127,23 @@ describe('bucket encryption state', () => {
     expect(refused.encryption.status.value).toBeNull()
   })
 
+  it('keeps the last answer marked out of date after a passing failure and holds back changes', async () => {
+    const { encryption } = setup()
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+    getBucketEncryption.mockRejectedValueOnce(new TypeError('network down'))
+
+    await encryption.load()
+
+    expect(encryption.state.value).toBe('stale')
+    expect(encryption.status.value?.bucket_id).toBe('B1')
+    await expect(encryption.lock()).rejects.toThrow('not known right now')
+    expect(lockBucket).not.toHaveBeenCalled()
+    getBucketEncryption.mockRejectedValueOnce(new Api.ApiError(404, 'Not found'))
+    await encryption.load()
+    expect(encryption.state.value).toBe('missing')
+    expect(encryption.status.value).toBeNull()
+  })
+
   it('unlocks with the context of the shown key and reads the status before answering', async () => {
     const { encryption } = setup()
     await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index c89c41a7..f1ab290b 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -22,8 +22,11 @@ import { authToken, nodeInfo, realmInfo, sessionEpoch, userInfo } from './aruna/
 import { localNodeId, nodeApiBase } from './s3/endpoints'
 import { useUserVault } from './useUserVault'
 
-/** `missing`: the node does not report encryption for this bucket, which is not "off". */
-export type EncryptionLoadState = 'loading' | 'ready' | 'missing' | 'refused' | 'unresolved' | 'failed'
+/**
+ * `missing`: the node does not report encryption for this bucket, which is not "off".
+ * `stale`: the last read failed; the status is the previous answer and changes are held back.
+ */
+export type EncryptionLoadState = 'loading' | 'ready' | 'stale' | 'missing' | 'refused' | 'unresolved' | 'failed'
 export type EncryptionAction = 'unlock' | 'extend' | 'lock' | 'save' | 'rotate'
 
 export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | null>, groupId: Ref<string | null>) {
@@ -90,8 +93,8 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
     ])
     if (!live()) return
     refreshing.value = false
-    compression.value = compressed.status === 'fulfilled' ? compressed.value : null
     if (encryption.status === 'fulfilled') {
+      compression.value = compressed.status === 'fulfilled' ? compressed.value : null
       status.value = encryption.value
       revision.value += 1
       state.value = 'ready'
@@ -99,13 +102,21 @@ export function useBucketEncryption(bucket: Ref<string>, nodeId: Ref<string | nu
       outcomeUnknown.value = false
       return
     }
-    status.value = null
-    state.value = failed(encryption.reason)
+    const next = failed(encryption.reason)
     error.value = apiErrorMessage(encryption.reason)
+    if (next === 'failed' && status.value) {
+      // A passing failure keeps the last answer, marked out of date, so an open draft survives.
+      state.value = 'stale'
+      return
+    }
+    status.value = null
+    compression.value = null
+    state.value = next
   }
 
   async function run<T>(action: EncryptionAction, work: (bound: () => boolean) => Promise<T>): Promise<T | null> {
     if (busy.value) throw new Error('Another change to this bucket is still running.')
+    if (state.value !== 'ready') throw new Error('The state of this bucket is not known right now. Read it again first.')
     const bound = binder()
     busy.value = action
     let outcome: { done: true; value: T } | { done: false; cause: unknown }

From 564fc1adda250f695c71396f760787935f5b643d Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:27:52 +0200
Subject: [PATCH 38/86] fix: remove a key holder only from the holder set the
 warning showed

---
 .../storage/BucketHoldersSection.test.ts      | 20 +++++++--
 .../storage/BucketHoldersSection.vue          | 45 ++++++++++++-------
 src/composables/useBucketHolders.test.ts      |  6 +--
 src/composables/useBucketHolders.ts           |  7 ++-
 4 files changed, 53 insertions(+), 25 deletions(-)

diff --git a/src/components/storage/BucketHoldersSection.test.ts b/src/components/storage/BucketHoldersSection.test.ts
index b6f3c260..4fc71444 100644
--- a/src/components/storage/BucketHoldersSection.test.ts
+++ b/src/components/storage/BucketHoldersSection.test.ts
@@ -84,7 +84,7 @@ describe('bucket key holder list', () => {
     expect(text).toContain('does not erase copies')
     expect(() => rowButton(root, 'Ada')).toThrow()
     await click(rowButton(root, 'Cy'))
-    expect(remove).toHaveBeenCalledWith('Cy', false)
+    expect(remove).toHaveBeenCalledWith('Cy', false, 'rev-1')
   })
 
   it('asks before a removal that breaks recovery and sends the confirmation', async () => {
@@ -98,7 +98,7 @@ describe('bucket key holder list', () => {
     await click(element(root, (node) => node.tag === 'input' && node.props.type === 'checkbox'))
     await click(button(root, 'Remove anyway'))
 
-    expect(remove).toHaveBeenCalledWith('Bo', true)
+    expect(remove).toHaveBeenCalledWith('Bo', true, 'rev-1')
   })
 
   it('marks a partial list and asks before a removal whose effect cannot be verified', async () => {
@@ -119,7 +119,7 @@ describe('bucket key holder list', () => {
 
     await click(rowButton(root, 'Cy'))
 
-    expect(remove).toHaveBeenCalledWith('Cy', false)
+    expect(remove).toHaveBeenCalledWith('Cy', false, 'rev-1')
     expect(content(root)).toContain('Remove Cy?')
   })
 
@@ -155,4 +155,18 @@ describe('bucket key holder list', () => {
     expect(content(root)).toContain('The user search failed: The directory did not answer.')
     expect(content(root)).not.toContain('No matching users.')
   })
+
+  it('asks again when the holder set changes while the removal warning is open', async () => {
+    const root = await render([holder('Ada'), holder('Bo')])
+    await click(rowButton(root, 'Bo'))
+    await click(element(root, (node) => node.tag === 'input' && node.props.type === 'checkbox'))
+
+    holders.value = { ...holders.value!, revision: 'rev-2' }
+    await flush()
+    await click(button(root, 'Remove anyway'))
+
+    expect(content(root)).toContain('The key holders changed while this was open.')
+    expect(button(root, 'Remove anyway').props.disabled).toBe(true)
+    expect(remove).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index df6fd6f1..badf2038 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -38,8 +38,14 @@ const recovery = computed(() => recoverySummary(holders.value ? listedRecovery(h
 const partial = computed(() => Boolean(holders.value && holders.value.complete !== true))
 const busy = ref<string | null>(null)
 const failure = ref<string | null>(null)
-const pending = ref<BucketHolderEntry | null>(null)
-const pendingRecovery = ref<Exclude<RecoveryAfter, 'kept'>>('unmet')
+/** A confirmation belongs to the holder set it was shown for; a newer set needs a new one. */
+interface PendingRemoval {
+  entry: BucketHolderEntry
+  revision: string
+  recovery: Exclude<RecoveryAfter, 'kept'>
+}
+const pending = ref<PendingRemoval | null>(null)
+const pendingStale = computed(() => Boolean(pending.value && holders.value?.revision !== pending.value.revision))
 const accepted = ref(false)
 
 const query = ref('')
@@ -89,13 +95,13 @@ async function addHolder() {
   }
 }
 
-async function removeHolder(entry: BucketHolderEntry, confirm: boolean) {
+async function removeHolder(entry: BucketHolderEntry, confirm: boolean, revision: string) {
   busy.value = entry.user_id
   failure.value = null
   try {
-    const result = await remove(entry.user_id, confirm)
-    if (result === 'confirm' && pending.value !== entry) pendingRecovery.value = 'unmet'
-    pending.value = result === 'confirm' ? entry : null
+    const result = await remove(entry.user_id, confirm, revision)
+    const recovery = pending.value?.entry === entry ? pending.value.recovery : 'unmet'
+    pending.value = result === 'confirm' ? { entry, revision, recovery } : null
     accepted.value = false
   } catch (cause) {
     failure.value = encryptionError(cause)
@@ -105,14 +111,20 @@ async function removeHolder(entry: BucketHolderEntry, confirm: boolean) {
 }
 
 function startRemove(entry: BucketHolderEntry) {
-  const after = holders.value ? recoveryAfter(holders.value, entry.user_id) : 'unknown'
+  const shown = holders.value
+  if (!shown) return
+  const after = recoveryAfter(shown, entry.user_id)
   if (after === 'kept') {
-    void removeHolder(entry, false)
+    void removeHolder(entry, false, shown.revision)
     return
   }
   accepted.value = false
-  pendingRecovery.value = after
-  pending.value = entry
+  pending.value = { entry, revision: shown.revision, recovery: after }
+}
+
+function confirmRemoval() {
+  const asked = pending.value
+  if (asked && !pendingStale.value) void removeHolder(asked.entry, true, asked.revision)
 }
 </script>
 
@@ -192,9 +204,9 @@ function startRemove(entry: BucketHolderEntry) {
     <Dialog :open="Boolean(pending)" @update:open="(open: boolean) => !open && (pending = null)">
       <DialogContent class="max-w-md">
         <DialogHeader>
-          <DialogTitle>Remove {{ pending ? nameOf(pending) : '' }}?</DialogTitle>
+          <DialogTitle>Remove {{ pending ? nameOf(pending.entry) : '' }}?</DialogTitle>
           <DialogDescription>
-            <template v-if="pendingRecovery === 'unmet'">
+            <template v-if="pending?.recovery === 'unmet'">
               After this removal the recovery rule is not met: fewer than two ready key holders remain, and none has a
               recovery code.
             </template>
@@ -205,10 +217,13 @@ function startRemove(entry: BucketHolderEntry) {
             If the remaining usable key is then lost too, the data in this bucket cannot be read again.
           </DialogDescription>
         </DialogHeader>
+        <Notice v-if="pendingStale" tone="warning">
+          The key holders changed while this was open. Close it and check the list again.
+        </Notice>
         <label class="flex items-start gap-2 text-xs text-muted-foreground">
           <input type="checkbox" class="mt-0.5" :checked="accepted" @click="accepted = !accepted" />
           <span>
-            {{ pendingRecovery === 'unmet' ? 'I accept that the recovery rule is not met.' : 'I accept that recovery cannot be verified.' }}
+            {{ pending?.recovery === 'unmet' ? 'I accept that the recovery rule is not met.' : 'I accept that recovery cannot be verified.' }}
           </span>
         </label>
         <DialogFooter>
@@ -216,8 +231,8 @@ function startRemove(entry: BucketHolderEntry) {
           <Button
             variant="destructive"
             size="sm"
-            :disabled="!accepted || busy !== null || frozen"
-            @click="pending && removeHolder(pending, true)"
+            :disabled="!accepted || busy !== null || frozen || pendingStale"
+            @click="confirmRemoval"
           >
             Remove anyway
           </Button>
diff --git a/src/composables/useBucketHolders.test.ts b/src/composables/useBucketHolders.test.ts
index 00294724..c86ecbe7 100644
--- a/src/composables/useBucketHolders.test.ts
+++ b/src/composables/useBucketHolders.test.ts
@@ -112,8 +112,8 @@ describe('bucket key holders', () => {
     await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
     removeBucketHolder.mockRejectedValueOnce(refusal('recovery_confirmation_required'))
 
-    expect(await holders.remove('A', false)).toBe('confirm')
-    expect(await holders.remove('A', true)).toBe('removed')
+    expect(await holders.remove('A', false, 'rev-1')).toBe('confirm')
+    expect(await holders.remove('A', true, 'rev-1')).toBe('removed')
 
     expect(removeBucketHolder.mock.calls.map((call) => call.slice(0, 4))).toEqual([
       ['reef', 'A', 'rev-1', false],
@@ -128,7 +128,7 @@ describe('bucket key holders', () => {
     removeBucketHolder.mockRejectedValueOnce(refusal('stale_holders'))
     listBucketHolders.mockResolvedValue(listing([holder('A'), holder('B'), holder('C')], 'rev-2'))
 
-    await expect(holders.remove('A', false)).rejects.toThrow('changed meanwhile')
+    await expect(holders.remove('A', false, 'rev-1')).rejects.toThrow('changed meanwhile')
 
     await vi.waitFor(() => expect(holders.holders.value?.revision).toBe('rev-2'))
   })
diff --git a/src/composables/useBucketHolders.ts b/src/composables/useBucketHolders.ts
index 4bed8ae9..b17478de 100644
--- a/src/composables/useBucketHolders.ts
+++ b/src/composables/useBucketHolders.ts
@@ -101,10 +101,9 @@ export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
     }
   }
 
-  /** Without `confirmRecovery`, a removal that breaks recovery comes back as `confirm`. */
-  async function remove(userId: string, confirmRecovery: boolean): Promise<RemovalResult> {
-    const revision = holders.value?.revision
-    if (!revision) throw new Error('The key holders are not known yet.')
+  // Without `confirmRecovery` a removal that breaks recovery comes back as `confirm`. `revision`
+  // names the holder set the caller showed; the node refuses the removal once the set changed.
+  async function remove(userId: string, confirmRecovery: boolean, revision: string): Promise<RemovalResult> {
     const bound = source.binder()
     try {
       await removeBucketHolder(bucket.value, userId, revision, confirmRecovery, source.client())

From c35342bf3686a3733019e71d64ad4de8350669d5 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:28:01 +0200
Subject: [PATCH 39/86] fix: claim a bucket has no key holders only from a
 complete list

---
 src/components/storage/BucketHoldersSection.test.ts | 8 ++++++++
 src/components/storage/BucketHoldersSection.vue     | 4 +++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/components/storage/BucketHoldersSection.test.ts b/src/components/storage/BucketHoldersSection.test.ts
index 4fc71444..4b12d2d1 100644
--- a/src/components/storage/BucketHoldersSection.test.ts
+++ b/src/components/storage/BucketHoldersSection.test.ts
@@ -169,4 +169,12 @@ describe('bucket key holder list', () => {
     expect(button(root, 'Remove anyway').props.disabled).toBe(true)
     expect(remove).not.toHaveBeenCalled()
   })
+
+  it('claims no key holders only for a complete list', async () => {
+    expect(content(await render([]))).toContain('This bucket has no key holders.')
+
+    const partial = content(await render([], true, false))
+    expect(partial).toContain('No key holder could be looked up.')
+    expect(partial).not.toContain('has no key holders')
+  })
 })
diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index badf2038..d036b4ed 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -165,7 +165,9 @@ function confirmRemoval() {
             </Button>
           </li>
         </ul>
-        <p v-if="!list.length" class="text-xs text-muted-foreground">This bucket has no key holders.</p>
+        <p v-if="!list.length" class="text-xs text-muted-foreground">
+          {{ partial ? 'No key holder could be looked up.' : 'This bucket has no key holders.' }}
+        </p>
         <Notice tone="warning">Removing a key holder does not erase copies of the key they already made.</Notice>
       </template>
 

From ddcb13f948bbef5df5c614424b7fe7fb17aa8514 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:28:16 +0200
Subject: [PATCH 40/86] fix: say that a bucket lock covers every key generation

---
 src/components/storage/BucketKeyAccess.test.ts | 3 ++-
 src/components/storage/BucketKeyAccess.vue     | 5 ++++-
 src/docs/v1.ts                                 | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/components/storage/BucketKeyAccess.test.ts b/src/components/storage/BucketKeyAccess.test.ts
index 1f2d56bb..86ca54db 100644
--- a/src/components/storage/BucketKeyAccess.test.ts
+++ b/src/components/storage/BucketKeyAccess.test.ts
@@ -122,7 +122,8 @@ describe('bucket key access', () => {
     const root = await render(status({ generations: [key(3, 'active'), key(2, 'source', OPEN)] }))
 
     await click(button(row(root, 2), 'Extend'))
-    await click(button(root, 'Lock now'))
+    expect(content(root)).toContain('Locks every key of this bucket at once, previous keys included.')
+    await click(button(root, 'Lock all keys'))
 
     expect(extend).toHaveBeenCalledWith(2, undefined)
     expect(lock).toHaveBeenCalledOnce()
diff --git a/src/components/storage/BucketKeyAccess.vue b/src/components/storage/BucketKeyAccess.vue
index 1325ef45..0149a372 100644
--- a/src/components/storage/BucketKeyAccess.vue
+++ b/src/components/storage/BucketKeyAccess.vue
@@ -101,7 +101,10 @@ function extendKey(key: BucketKeyGeneration) {
         </li>
       </ul>
       <div class="flex flex-wrap items-center gap-2">
-        <Button v-if="canLock" size="sm" variant="outline" :disabled="busy" @click="act(lock)">Lock now</Button>
+        <template v-if="canLock">
+          <Button size="sm" variant="outline" :disabled="busy" @click="act(lock)">Lock all keys</Button>
+          <span class="text-xs text-muted-foreground">Locks every key of this bucket at once, previous keys included.</span>
+        </template>
         <span v-if="!anyAction" class="text-xs text-muted-foreground">No key action is open to you right now.</span>
       </div>
       <Notice v-if="actionError" tone="error">{{ actionError }}</Notice>
diff --git a/src/docs/v1.ts b/src/docs/v1.ts
index ced851ad..0265e639 100644
--- a/src/docs/v1.ts
+++ b/src/docs/v1.ts
@@ -830,7 +830,7 @@ export const docsTopics: DocsTopic[] = [
           'Choose Unlock. Your vault opens in this browser; enter its passphrase when it is locked.',
           'Pick how long the unlock lasts, within the bucket maximum.',
           'The browser opens your copy of the bucket key and sends only the bucket key to the node that hosts the bucket.',
-          'Extend a timed unlock, or choose Lock now when you are done.',
+          'Extend a timed unlock, or choose Lock all keys when you are done. It locks every key of the bucket, previous keys included.',
         ],
         paragraphs: [
           'An unlock lets every reader with access on that node read the bucket until it locks. When the node does not confirm an unlock, the portal reads the bucket state first and never sends the key again on its own.',

From 00325f5c3d6234d3a6170680ef1f29eb3fe466f6 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:29:20 +0200
Subject: [PATCH 41/86] fix: let only the newest preview load set the preview
 state

---
 src/composables/useObjectPreview.test.ts | 25 +++++++++++++++++++++
 src/composables/useObjectPreview.ts      | 28 ++++++++++++++++--------
 2 files changed, 44 insertions(+), 9 deletions(-)

diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index aee38119..6f6a031f 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -82,4 +82,29 @@ describe('preview of a locked bucket', () => {
     expect(preview.status.value).toBe('error')
     expect(preview.lockedLink.value).toBeNull()
   })
+
+  it('lets an older load neither end the waiting state of a newer one nor overwrite its content', async () => {
+    let failOld!: (reason: unknown) => void
+    getObjectText.mockReturnValueOnce(new Promise((_, reject) => (failOld = reject)))
+    getObjectText.mockRejectedValueOnce(LOCKED)
+    const preview = useObjectPreview()
+
+    const old = preview.load({ ...TARGET, key: 'old.txt' })
+    await preview.load(TARGET)
+    failOld(new Error('late failure'))
+    await old
+
+    expect(preview.status.value).toBe('locked')
+    expect(preview.errorMessage.value).toBeNull()
+
+    let answerOld!: (value: string) => void
+    getObjectText.mockReturnValueOnce(new Promise((resolve) => (answerOld = resolve)))
+    getObjectText.mockResolvedValueOnce('new text')
+    const older = preview.load({ ...TARGET, key: 'old.txt' })
+    await preview.load(TARGET)
+    answerOld('old text')
+    await older
+
+    expect(preview.text.value).toBe('new text')
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index b6e1fa33..8b1d2610 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -164,18 +164,22 @@ export function useObjectPreview() {
     }
   }
 
-  async function fallbackDownload(target: PreviewTarget, cap: number, actual: number) {
+  async function fallbackDownload(target: PreviewTarget, cap: number, actual: number, id: number) {
     kind.value = 'download'
     sizeNote.value = `This file is ${formatBytes(actual)}, above the ${formatBytes(cap)} preview limit.`
     try {
-      directUrl.value = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
+      const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
+      if (id !== loadId) return
+      directUrl.value = url
       status.value = 'ready'
     } catch (err) {
+      if (id !== loadId) return
       errorMessage.value = s3ErrorMessage(err)
       status.value = 'error'
     }
   }
 
+  // Every await below is followed by a check of `id`: a newer load owns the state.
   async function load(target: PreviewTarget) {
     reset()
     const id = loadId
@@ -186,29 +190,33 @@ export function useObjectPreview() {
     try {
       if (classified.kind === 'media' || classified.kind === 'pdf' || classified.kind === 'download') {
         if (classified.kind === 'media') mediaKind.value = mediaSubtype(target)
-        directUrl.value = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
+        const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
+        if (id !== loadId) return
+        directUrl.value = url
         status.value = 'ready'
         return
       }
 
       const cap = classified.kind === 'image' ? IMAGE_CAP : classified.kind === 'table' ? TABLE_CAP : TEXT_CAP
       if (typeof target.size === 'number' && target.size > cap) {
-        await fallbackDownload(target, cap, target.size)
+        await fallbackDownload(target, cap, target.size, id)
         return
       }
 
       if (classified.kind === 'image') {
         const blob = await s3.getObjectBlob(target.bucket, target.key, target.nodeId, target.versionId)
+        if (id !== loadId) return
         if (blob.size > cap) {
-          await fallbackDownload(target, cap, blob.size)
+          await fallbackDownload(target, cap, blob.size, id)
           return
         }
         objectUrl.value = URL.createObjectURL(blob)
       } else {
         const content = await s3.getObjectText(target.bucket, target.key, target.nodeId, target.versionId)
+        if (id !== loadId) return
         // Coarse guard for objects whose size was not listed up front.
         if (content.length > cap) {
-          await fallbackDownload(target, cap, content.length)
+          await fallbackDownload(target, cap, content.length, id)
           return
         }
         text.value = classified.language === 'json' ? prettyJson(content) : content
@@ -216,7 +224,8 @@ export function useObjectPreview() {
       }
       status.value = 'ready'
     } catch (err) {
-      if (id === loadId && isS3BucketLockedError(err)) {
+      if (id !== loadId) return
+      if (isS3BucketLockedError(err)) {
         lockedTarget.value = target
         status.value = 'locked'
         return
@@ -226,11 +235,12 @@ export function useObjectPreview() {
       if (err instanceof TypeError) corsBlocked.value = true
       else errorMessage.value = s3ErrorMessage(err)
       try {
-        directUrl.value = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
+        const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
+        if (id === loadId) directUrl.value = url
       } catch {
         // Leave directUrl null; the pane still offers its own download button.
       }
-      status.value = 'error'
+      if (id === loadId) status.value = 'error'
     }
   }
 

From 0eac496b4f472d6d0cb774ef7e3245b61d0426c5 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:32:08 +0200
Subject: [PATCH 42/86] fix: check a locked bucket before a direct viewer or a
 download

---
 src/components/preview/PdfPreview.test.ts | 44 +++++++++++++++++++++++
 src/components/preview/PdfPreview.vue     |  6 ++++
 src/components/preview/PreviewBody.vue    |  2 ++
 src/composables/s3/objects.ts             | 14 ++++++++
 src/composables/s3/read.test.ts           | 24 ++++++++++++-
 src/composables/useObjectPreview.test.ts  | 25 ++++++++++++-
 src/composables/useObjectPreview.ts       | 24 +++++++++++--
 src/composables/useS3.ts                  |  2 ++
 src/lib/tutorial/services/tutorialS3.ts   |  1 +
 9 files changed, 138 insertions(+), 4 deletions(-)
 create mode 100644 src/components/preview/PdfPreview.test.ts

diff --git a/src/components/preview/PdfPreview.test.ts b/src/components/preview/PdfPreview.test.ts
new file mode 100644
index 00000000..b6b9bd42
--- /dev/null
+++ b/src/components/preview/PdfPreview.test.ts
@@ -0,0 +1,44 @@
+import { defineComponent, h } from 'vue'
+import * as VueRuntime from 'vue'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as Errors from '@/composables/s3/errors'
+import { compileClientComponent, flush, mountApp, moduleDefault } from '@/test/clientRender'
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+
+const pdf = compileClientComponent(new URL('./PdfPreview.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
+  '@/composables/s3/errors': Errors,
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/EmptyState.vue': moduleDefault(Slotted('section')),
+  '@/components/ui/Skeleton.vue': moduleDefault(Slotted('div')),
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('pdf preview', () => {
+  it('reports a locked bucket instead of a plain loading failure', async () => {
+    const headers = { 'x-aruna-bucket-locked': 'true' }
+    vi.stubGlobal('fetch', vi.fn(async () => new Response('<Error/>', { status: 403, headers })))
+    const onLocked = vi.fn()
+
+    await mountApp(pdf, { props: { url: 'https://b.test/presigned', onLocked } })
+    await flush()
+
+    expect(onLocked).toHaveBeenCalledOnce()
+  })
+
+  it('keeps an ordinary refusal a loading failure', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => new Response('<Error/>', { status: 403 })))
+    const onLocked = vi.fn()
+
+    await mountApp(pdf, { props: { url: 'https://b.test/presigned', onLocked } })
+    await flush()
+
+    expect(onLocked).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/components/preview/PdfPreview.vue b/src/components/preview/PdfPreview.vue
index 7318ed25..dac2b091 100644
--- a/src/components/preview/PdfPreview.vue
+++ b/src/components/preview/PdfPreview.vue
@@ -3,12 +3,14 @@
 // api/src/csp.rs serves `frame-src blob:`); the bytes are fetched over the
 // already-allowed connect-src path, so the iframe never touches the S3 origin.
 import { onBeforeUnmount, onMounted, ref } from 'vue'
+import { BUCKET_LOCKED_HEADER } from '@/composables/s3/errors'
 import Button from '@/components/ui/Button.vue'
 import EmptyState from '@/components/ui/EmptyState.vue'
 import Skeleton from '@/components/ui/Skeleton.vue'
 import { ExternalLink, FileText } from '@lucide/vue'
 
 const props = defineProps<{ url: string; name?: string }>()
+const emit = defineEmits<{ (e: 'locked'): void }>()
 
 const blobUrl = ref<string | null>(null)
 const failed = ref(false)
@@ -21,6 +23,10 @@ function openTab() {
 onMounted(async () => {
   try {
     const response = await fetch(props.url)
+    if (response.status === 403 && response.headers.get(BUCKET_LOCKED_HEADER) === 'true') {
+      emit('locked')
+      return
+    }
     if (!response.ok) throw new Error(`HTTP ${response.status}`)
     const blob = await response.blob()
     blobUrl.value = URL.createObjectURL(new Blob([blob], { type: 'application/pdf' }))
diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 6cccc762..85d0d76f 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -94,6 +94,7 @@ async function download() {
         props.versionId ?? undefined,
         props.name,
       ))
+    if (!(await preview.checkAccess(url))) return
     // In the document, not detached: a detached anchor is ignored by some
     // browsers, and the name travels in the response's Content-Disposition.
     const anchor = document.createElement('a')
@@ -231,6 +232,7 @@ async function download() {
         v-else-if="preview.kind.value === 'pdf' && preview.directUrl.value"
         :url="preview.directUrl.value"
         :name="props.name"
+        @locked="preview.markLocked()"
       />
       <DownloadCard
         v-else
diff --git a/src/composables/s3/objects.ts b/src/composables/s3/objects.ts
index a58b56f8..b03f25cf 100644
--- a/src/composables/s3/objects.ts
+++ b/src/composables/s3/objects.ts
@@ -854,6 +854,20 @@ async function fetchObject(
   return response
 }
 
+// Reads one byte through a signed URL, so a locked bucket is seen before a viewer or a
+// download is offered. A failed or unclear probe never blocks; the viewer reports it.
+export async function probeObjectAccess(url: string): Promise<'open' | 'locked' | 'unknown'> {
+  if (!/^https?:/i.test(url)) return 'unknown'
+  try {
+    const response = await fetch(url, { headers: { Range: 'bytes=0-0' } })
+    void response.body?.cancel().catch(() => undefined)
+    if (response.status === 403 && response.headers.get(BUCKET_LOCKED_HEADER) === 'true') return 'locked'
+    return response.ok ? 'open' : 'unknown'
+  } catch {
+    return 'unknown'
+  }
+}
+
 export async function getObjectText(
   bucket: string,
   key: string,
diff --git a/src/composables/s3/read.test.ts b/src/composables/s3/read.test.ts
index 292d1aa4..2b720846 100644
--- a/src/composables/s3/read.test.ts
+++ b/src/composables/s3/read.test.ts
@@ -3,7 +3,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 vi.mock('./client', () => ({ client: () => ({}) }))
 vi.mock('@aws-sdk/s3-request-presigner', () => ({ getSignedUrl: async () => 'https://s3.example/object' }))
 
-const { getObjectText } = await import('./objects')
+const { getObjectText, probeObjectAccess } = await import('./objects')
 
 afterEach(() => vi.unstubAllGlobals())
 
@@ -16,4 +16,26 @@ describe('object reads', () => {
       })
     }
   })
+
+  it('marks a locked bucket only when the node sends the lock header', async () => {
+    const locked = () => new Response('', { status: 403, headers: { 'x-aruna-bucket-locked': 'true' } })
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(locked()))
+    await expect(getObjectText('bucket', 'notes.txt')).rejects.toMatchObject({ bucketLocked: true })
+
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('', { status: 403 })))
+    await expect(getObjectText('bucket', 'notes.txt')).rejects.toMatchObject({ bucketLocked: false })
+  })
+
+  it('probes access with a one-byte range and never blocks on an unclear answer', async () => {
+    const fetch = vi.fn().mockResolvedValue(new Response('', { status: 403, headers: { 'x-aruna-bucket-locked': 'true' } }))
+    vi.stubGlobal('fetch', fetch)
+    expect(await probeObjectAccess('https://s3.example/object')).toBe('locked')
+    expect(fetch.mock.calls[0][1]).toEqual({ headers: { Range: 'bytes=0-0' } })
+
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('x', { status: 206 })))
+    expect(await probeObjectAccess('https://s3.example/object')).toBe('open')
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('cors')))
+    expect(await probeObjectAccess('https://s3.example/object')).toBe('unknown')
+    expect(await probeObjectAccess('blob:local')).toBe('unknown')
+  })
 })
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 6f6a031f..86f1a7c4 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -4,10 +4,11 @@ import type { BucketEncryptionResponse, BucketUnlockStatus } from '@/lib/api'
 import { useObjectPreview } from './useObjectPreview'
 
 const getObjectText = vi.fn()
+const probeAccess = vi.fn()
 const getBucketEncryption = vi.fn()
 
 vi.mock('./useS3', () => ({
-  useS3: () => ({ getObjectText, downloadUrl: async () => 'https://b.test/presigned' }),
+  useS3: () => ({ getObjectText, probeAccess, downloadUrl: async () => 'https://b.test/presigned' }),
   s3ErrorMessage: (error: unknown) => (error instanceof Error ? error.message : String(error)),
 }))
 vi.mock('./s3/endpoints', () => ({
@@ -35,6 +36,7 @@ function lockState(state: BucketUnlockStatus['state']): BucketEncryptionResponse
 
 beforeEach(() => {
   getObjectText.mockReset()
+  probeAccess.mockReset().mockResolvedValue('open')
   getBucketEncryption.mockReset()
 })
 
@@ -107,4 +109,25 @@ describe('preview of a locked bucket', () => {
 
     expect(preview.text.value).toBe('new text')
   })
+
+  it('reads one byte before it offers a direct viewer, an oversized download or the download button', async () => {
+    probeAccess.mockResolvedValue('locked')
+    const preview = useObjectPreview()
+
+    await preview.load({ ...TARGET, key: 'clip.mp4' })
+    expect(preview.status.value).toBe('locked')
+    expect(preview.directUrl.value).toBeNull()
+
+    await preview.load({ ...TARGET, size: 50 * 1024 * 1024 })
+    expect(preview.status.value).toBe('locked')
+    expect(getObjectText).not.toHaveBeenCalled()
+
+    probeAccess.mockResolvedValue('open')
+    await preview.load({ ...TARGET, key: 'paper.pdf' })
+    expect(preview.status.value).toBe('ready')
+    probeAccess.mockResolvedValueOnce('locked')
+    expect(await preview.checkAccess('https://b.test/presigned')).toBe(false)
+    expect(preview.status.value).toBe('locked')
+    expect(probeAccess).toHaveBeenCalledWith('https://b.test/presigned')
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 8b1d2610..193e27ba 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -115,6 +115,7 @@ export function useObjectPreview() {
   const status = ref<'idle' | 'loading' | 'ready' | 'error' | 'locked'>('idle')
   const lockCheck = ref<'idle' | 'checking' | 'still' | 'failed'>('idle')
   const lockedTarget = shallowRef<PreviewTarget | null>(null)
+  let currentTarget: PreviewTarget | null = null
   let loadId = 0
   const kind = ref<PreviewKind>('download')
   const language = ref<string | undefined>(undefined)
@@ -145,6 +146,7 @@ export function useObjectPreview() {
     referenced.value = false
     lockCheck.value = 'idle'
     lockedTarget.value = null
+    currentTarget = null
     ++loadId
     ++referenceProbeId
   }
@@ -164,12 +166,27 @@ export function useObjectPreview() {
     }
   }
 
+  /** Switches the current preview to waiting for a bucket unlock. */
+  function markLocked() {
+    if (!currentTarget) return
+    lockedTarget.value = currentTarget
+    status.value = 'locked'
+  }
+
+  /** False when a newer load took over, or when the bucket turned out to be locked. */
+  async function checkAccess(url: string, id = loadId): Promise<boolean> {
+    const access = await s3.probeAccess(url)
+    if (id !== loadId) return false
+    if (access === 'locked') markLocked()
+    return access !== 'locked'
+  }
+
   async function fallbackDownload(target: PreviewTarget, cap: number, actual: number, id: number) {
     kind.value = 'download'
     sizeNote.value = `This file is ${formatBytes(actual)}, above the ${formatBytes(cap)} preview limit.`
     try {
       const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
-      if (id !== loadId) return
+      if (id !== loadId || !(await checkAccess(url, id))) return
       directUrl.value = url
       status.value = 'ready'
     } catch (err) {
@@ -183,6 +200,7 @@ export function useObjectPreview() {
   async function load(target: PreviewTarget) {
     reset()
     const id = loadId
+    currentTarget = target
     status.value = 'loading'
     const classified = classifyObject(target)
     kind.value = classified.kind
@@ -191,7 +209,7 @@ export function useObjectPreview() {
       if (classified.kind === 'media' || classified.kind === 'pdf' || classified.kind === 'download') {
         if (classified.kind === 'media') mediaKind.value = mediaSubtype(target)
         const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
-        if (id !== loadId) return
+        if (id !== loadId || !(await checkAccess(url, id))) return
         directUrl.value = url
         status.value = 'ready'
         return
@@ -274,6 +292,8 @@ export function useObjectPreview() {
     lockCheck,
     lockedLink,
     recheck,
+    markLocked,
+    checkAccess,
     kind,
     language,
     mediaKind,
diff --git a/src/composables/useS3.ts b/src/composables/useS3.ts
index 131c206b..4774232e 100644
--- a/src/composables/useS3.ts
+++ b/src/composables/useS3.ts
@@ -21,6 +21,7 @@ import {
   listObjects,
   listObjectsRecursive,
   listObjectVersions,
+  probeObjectAccess,
   putTextObject,
   resumeUpload,
   uploadObject,
@@ -150,5 +151,6 @@ function nodeS3() {
     getObjectText,
     getObjectBlob,
     fetchUrlText,
+    probeAccess: probeObjectAccess,
   }
 }
diff --git a/src/lib/tutorial/services/tutorialS3.ts b/src/lib/tutorial/services/tutorialS3.ts
index c817a25b..5faaba78 100644
--- a/src/lib/tutorial/services/tutorialS3.ts
+++ b/src/lib/tutorial/services/tutorialS3.ts
@@ -83,6 +83,7 @@ export function tutorialS3(userId: string): S3Surface {
     }),
     headObject: async (bucket: string, key: string) => objectHead(bucket, key),
     downloadUrl: async (bucket: string, key: string) => `${TUTORIAL_ENDPOINT}/${bucket}/${key}`,
+    probeAccess: async () => 'open' as const,
     getObjectText: async (bucket: string, key: string) => {
       const artifact = artifactFor(bucket, key)
       if (artifact?.text !== undefined) return artifact.text

From 317d1349a90b629b2151f088abdb3942e8aec230 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:32:48 +0200
Subject: [PATCH 43/86] fix: load a locked preview again once its bucket is
 confirmed plain

---
 src/components/preview/PreviewBody.vue   |  1 +
 src/composables/useObjectPreview.test.ts | 17 +++++++++++++++++
 src/composables/useObjectPreview.ts      | 10 +++++++---
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 85d0d76f..0c3e0a02 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -186,6 +186,7 @@ async function download() {
       </p>
       <p v-if="preview.lockCheck.value === 'still'">The bucket is still locked.</p>
       <p v-else-if="preview.lockCheck.value === 'failed'">The lock state of the bucket could not be read.</p>
+      <p v-else-if="preview.lockCheck.value === 'unknown'">The node did not say whether the bucket still needs a key.</p>
       <Button variant="outline" size="sm" :disabled="preview.lockCheck.value === 'checking'" @click="preview.recheck()">
         Check again
       </Button>
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 86f1a7c4..042df5fd 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -130,4 +130,21 @@ describe('preview of a locked bucket', () => {
     expect(preview.status.value).toBe('locked')
     expect(probeAccess).toHaveBeenCalledWith('https://b.test/presigned')
   })
+
+  it('loads again once the node confirms the bucket is plain, and keeps an unreported key state unknown', async () => {
+    getObjectText.mockRejectedValueOnce(LOCKED)
+    const preview = useObjectPreview()
+    await preview.load(TARGET)
+
+    getBucketEncryption.mockResolvedValueOnce({ mode: 'off' } as BucketEncryptionResponse)
+    await preview.recheck()
+    expect(preview.lockCheck.value).toBe('unknown')
+    expect(getObjectText).toHaveBeenCalledTimes(1)
+
+    getBucketEncryption.mockResolvedValueOnce({ mode: 'off', generations: [] } as unknown as BucketEncryptionResponse)
+    getObjectText.mockResolvedValueOnce('plain again')
+    await preview.recheck()
+    expect(preview.status.value).toBe('ready')
+    expect(preview.text.value).toBe('plain again')
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 193e27ba..cf72db38 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -113,7 +113,8 @@ export function useObjectPreview() {
 
   /** `locked`: the bucket is encrypted and locked, so the content waits for an unlock. */
   const status = ref<'idle' | 'loading' | 'ready' | 'error' | 'locked'>('idle')
-  const lockCheck = ref<'idle' | 'checking' | 'still' | 'failed'>('idle')
+  /** `unknown`: the node answered without saying whether encrypted versions remain. */
+  const lockCheck = ref<'idle' | 'checking' | 'still' | 'unknown' | 'failed'>('idle')
   const lockedTarget = shallowRef<PreviewTarget | null>(null)
   let currentTarget: PreviewTarget | null = null
   let loadId = 0
@@ -280,8 +281,11 @@ export function useObjectPreview() {
       if (!baseUrl) throw new Error('The node publishes no API address.')
       const answer = await getBucketEncryption(target.bucket, { baseUrl, token: authToken.value })
       if (id !== loadId) return
-      if (keyGenerations(answer).list.some((key) => key.unlock.state === 'unlocked')) await load(target)
-      else lockCheck.value = 'still'
+      const { list, reported } = keyGenerations(answer)
+      // An unlocked key, or a bucket confirmed plain with no key left, may serve the content now.
+      const plain = answer.mode === 'off' && reported && list.length === 0
+      if (plain || list.some((key) => key.unlock.state === 'unlocked')) await load(target)
+      else lockCheck.value = answer.mode === 'off' && !reported ? 'unknown' : 'still'
     } catch {
       if (id === loadId) lockCheck.value = 'failed'
     }

From 0c32e70951771c24d05873990625e743068ab9fa Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:33:00 +0200
Subject: [PATCH 44/86] fix: promise no node takeover for a run that waits for
 a bucket key

---
 src/components/compute/TaskDetailPanel.vue       | 2 +-
 src/components/jobs/JobDistributedDetail.test.ts | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/components/compute/TaskDetailPanel.vue b/src/components/compute/TaskDetailPanel.vue
index 1e64981a..63e647fa 100644
--- a/src/components/compute/TaskDetailPanel.vue
+++ b/src/components/compute/TaskDetailPanel.vue
@@ -667,7 +667,7 @@ async function confirmDelete() {
           <p v-if="failed && stderrTail" class="truncate font-mono text-[11px]" :title="executorStderr(0)">
             stderr: {{ stderrTail }}
           </p>
-          <p v-if="task.state === 'QUEUED'" class="flex flex-wrap items-center gap-2 text-[11px]">
+          <p v-if="task.state === 'QUEUED' && !awaitingKey" class="flex flex-wrap items-center gap-2 text-[11px]">
             One node answers and runs it; another steps in after a while without a response.
             <DocsLink topic="compute-run" section="Follow the run" />
           </p>
diff --git a/src/components/jobs/JobDistributedDetail.test.ts b/src/components/jobs/JobDistributedDetail.test.ts
index 35ef42c1..58ba9f71 100644
--- a/src/components/jobs/JobDistributedDetail.test.ts
+++ b/src/components/jobs/JobDistributedDetail.test.ts
@@ -924,6 +924,7 @@ describe('distributed job detail components', () => {
     expect(mounted.errors).toEqual([])
     expect(content(mounted.root)).toContain(`waits for ${JSON.stringify(waits)}`)
     expect(content(mounted.root)).not.toContain('Queued, waiting for a node')
+    expect(content(mounted.root)).not.toContain('another steps in')
     mounted.app.unmount()
   })
 

From 31fbe1e99c55f2bff15a4f1afe2d7d890d9696f5 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:34:26 +0200
Subject: [PATCH 45/86] fix: drop an opened bucket key when the vault locks
 before it is sent

---
 .../useBucketEncryption.flow.test.ts          | 17 +++++++++++
 src/composables/useUserVault.test.ts          | 15 ++++++++++
 src/composables/useUserVault.ts               |  8 +++++
 src/lib/vault/bucketUnlock.test.ts            | 20 ++++++++++++-
 src/lib/vault/bucketUnlock.ts                 | 29 ++++++++++++++-----
 5 files changed, 81 insertions(+), 8 deletions(-)

diff --git a/src/composables/useBucketEncryption.flow.test.ts b/src/composables/useBucketEncryption.flow.test.ts
index fb5a6ce9..b25582a1 100644
--- a/src/composables/useBucketEncryption.flow.test.ts
+++ b/src/composables/useBucketEncryption.flow.test.ts
@@ -252,4 +252,21 @@ describe('unlocking a vault-locked bucket from the browser', () => {
     expect(outcome === null || outcome instanceof Error).toBe(true)
     expect(calls.some((call) => call.url.pathname.endsWith('/unlock'))).toBe(false)
   })
+
+  it('drops the key when the vault is locked before it is sent', async () => {
+    const { calls } = await fakeNodes()
+    const { vault: keys, useBucketEncryption } = await signIn()
+    await keys.load()
+    await keys.unlock(PASSPHRASE)
+    const encryption = scope.run(() => useBucketEncryption(ref('reef'), ref(copy.node_id), ref('g-1')))!
+    await vi.waitFor(() => expect(encryption.state.value).toBe('ready'))
+
+    const pending = encryption.unlock(copy.generation)
+    keys.lock()
+    const outcome = await pending.catch((error: unknown) => error)
+
+    expect(outcome).toBeInstanceOf(Error)
+    expect((outcome as Error).message).toBe('Your vault was locked, so the bucket key was not sent.')
+    expect(calls.some((call) => call.url.pathname.endsWith('/unlock'))).toBe(false)
+  })
 })
diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 77f663e0..bd7c68f9 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -437,6 +437,21 @@ describe('useUserVault', () => {
     await expect(vault.openUserKey(first.id)).rejects.toThrow('Unlock your provider keys first.')
   })
 
+  it('ends a key disclosure binding when the vault locks or the session changes', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', false)
+    const beforeLock = vault.whileUnlocked()
+    expect(beforeLock()).toBe(true)
+
+    vault.lock()
+    expect(beforeLock()).toBe(false)
+    await vault.unlock('correct horse')
+    expect(beforeLock()).toBe(false)
+    const afterUnlock = vault.whileUnlocked()
+    state.sessionEpoch.value += 1
+    expect(afterUnlock()).toBe(false)
+  })
+
   it('refuses a holder passphrase shorter than twelve characters', async () => {
     const { vault } = await boot()
     await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 03a2da6e..254fd2c9 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -548,6 +548,13 @@ async function checkKey(): Promise<OwnKeyState> {
   return ownKey.value
 }
 
+/** A check that stays true while the vault stays unlocked with the same key. */
+function whileUnlocked(): () => boolean {
+  const key = masterKey
+  const run = generation
+  return () => key !== null && masterKey === key && run === generation && state.value === 'unlocked'
+}
+
 /** Opens a keypair of the unlocked vault by id, retired ones included; null when it has none. */
 async function openUserKey(keyId: string): Promise<X25519Pair | null> {
   const { current, key } = requireUnlocked()
@@ -620,6 +627,7 @@ export function useUserVault() {
     rotateKey,
     checkKey,
     openUserKey,
+    whileUnlocked,
     dismissRecreateNotice,
   }
 }
diff --git a/src/lib/vault/bucketUnlock.test.ts b/src/lib/vault/bucketUnlock.test.ts
index 0e70ec4d..5c190d53 100644
--- a/src/lib/vault/bucketUnlock.test.ts
+++ b/src/lib/vault/bucketUnlock.test.ts
@@ -2,7 +2,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import { ApiError } from '@/lib/api'
 import vector from './__fixtures__/bucket-copy.json'
 import { importPrivateKey } from './hpke'
-import { NoUsableCopyError, UnlockStaleError, unlockWithVault, type UnlockTarget } from './bucketUnlock'
+import { NoUsableCopyError, UnlockStaleError, VaultClosedError, unlockWithVault, type UnlockTarget } from './bucketUnlock'
 
 function hex(text: string): Uint8Array<ArrayBuffer> {
   return Uint8Array.from(text.match(/../g) ?? [], (pair) => parseInt(pair, 16))
@@ -58,8 +58,11 @@ function node(copies: unknown[], unlock: () => Response | Promise<Response>) {
 
 function vault(keyIds = [vector.key_id]) {
   const order: string[] = []
+  const lifetime = { open: true }
   return {
     order,
+    lifetime,
+    whileUnlocked: () => () => lifetime.open,
     checkKey: vi.fn(async () => {
       order.push('check')
       return 'matches'
@@ -120,6 +123,21 @@ describe('bucket unlock from the browser', () => {
     expect(sent.map((call) => call.method)).toEqual(['GET'])
   })
 
+  it('drops the opened key when the vault locks before it is sent', async () => {
+    const sent = node([COPY], UNLOCKED)
+    const keys = vault()
+    const open = keys.openUserKey.getMockImplementation()!
+    keys.openUserKey.mockImplementation(async (keyId: string) => {
+      const pair = await open(keyId)
+      keys.lifetime.open = false
+      return pair
+    })
+
+    await expect(unlockWithVault(TARGET, keys, always)).rejects.toThrow(VaultClosedError)
+
+    expect(sent.filter((call) => call.method === 'POST')).toHaveLength(0)
+  })
+
   it('reports an unknown outcome once and does not send the key again', async () => {
     const sent = node([COPY], () => Promise.reject(new TypeError('network down')))
 
diff --git a/src/lib/vault/bucketUnlock.ts b/src/lib/vault/bucketUnlock.ts
index cd05b529..16dcb824 100644
--- a/src/lib/vault/bucketUnlock.ts
+++ b/src/lib/vault/bucketUnlock.ts
@@ -16,6 +16,8 @@ import { SealOpenError, fromBase64Url, type X25519Pair } from './hpke'
 export interface UnlockVault {
   checkKey(): Promise<string>
   openUserKey(keyId: string): Promise<X25519Pair | null>
+  /** A check that stays true while the vault stays unlocked with the same key. */
+  whileUnlocked(): () => boolean
 }
 
 export interface UnlockTarget {
@@ -41,6 +43,14 @@ export class UnlockStaleError extends Error {
   }
 }
 
+/** The vault was locked during the unlock, so the opened key was dropped unsent. */
+export class VaultClosedError extends Error {
+  constructor() {
+    super('Your vault was locked, so the bucket key was not sent.')
+    this.name = 'VaultClosedError'
+  }
+}
+
 /** No copy of the caller opens with this vault. */
 export class NoUsableCopyError extends Error {
   constructor(message: string) {
@@ -61,13 +71,13 @@ async function openFirst(
   copies: SealedCopyEntry[],
   target: UnlockTarget,
   vault: UnlockVault,
-  current: () => boolean,
+  guard: () => void,
 ): Promise<Uint8Array<ArrayBuffer>> {
   const publicKey = bytes(target.publicKey)
   let held = false
   for (const copy of copies) {
     const pair = await vault.openUserKey(copy.key_id)
-    if (!current()) throw new UnlockStaleError()
+    guard()
     if (!pair) continue
     held = true
     try {
@@ -95,23 +105,28 @@ export async function unlockWithVault(
   current: () => boolean,
 ): Promise<UnlockOutcome> {
   const ownKey = await vault.checkKey()
-  if (!current()) throw new UnlockStaleError()
+  const vaultOpen = vault.whileUnlocked()
+  const guard = () => {
+    if (!current()) throw new UnlockStaleError()
+    if (!vaultOpen()) throw new VaultClosedError()
+  }
+  guard()
   const { bucketId, generation } = target.context
   const response = await getMyCopies(target.bucket, generation, target.client)
-  if (!current()) throw new UnlockStaleError()
+  guard()
   const copies = response.copies
     .filter((copy) => copy.bucket_id === bucketId && copy.generation === generation)
     .sort((a, b) => b.created_at_ms - a.created_at_ms)
-  const key = await openFirst(copies, target, vault, current)
+  const key = await openFirst(copies, target, vault, guard)
   try {
-    if (!current()) throw new UnlockStaleError()
+    guard()
     const request = { bucket_id: bucketId, generation, duration_ms: target.durationMs }
     const status = await unlockBucket(target.bucket, request, key, target.client)
     return { kind: 'unlocked', status, ownKey }
   } catch (cause) {
     // Only a 4xx says the key was not applied; a 5xx or a lost answer says nothing.
     const answered = cause instanceof ApiError && cause.status < 500
-    if (answered || cause instanceof UnlockStaleError) throw cause
+    if (answered || cause instanceof UnlockStaleError || cause instanceof VaultClosedError) throw cause
     return { kind: 'unknown', ownKey }
   } finally {
     key.fill(0)

From 323956d580a5ba0a66726321db9d5d3ee56fd611 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:34:59 +0200
Subject: [PATCH 46/86] chore: keep the load state comment within three lines

---
 src/composables/useBucketEncryption.ts | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/composables/useBucketEncryption.ts b/src/composables/useBucketEncryption.ts
index f1ab290b..6a8d5eaf 100644
--- a/src/composables/useBucketEncryption.ts
+++ b/src/composables/useBucketEncryption.ts
@@ -22,10 +22,8 @@ import { authToken, nodeInfo, realmInfo, sessionEpoch, userInfo } from './aruna/
 import { localNodeId, nodeApiBase } from './s3/endpoints'
 import { useUserVault } from './useUserVault'
 
-/**
- * `missing`: the node does not report encryption for this bucket, which is not "off".
- * `stale`: the last read failed; the status is the previous answer and changes are held back.
- */
+// `missing`: the node does not report encryption for this bucket, which is not "off".
+// `stale`: the last read failed; the status is the previous answer and changes are held back.
 export type EncryptionLoadState = 'loading' | 'ready' | 'stale' | 'missing' | 'refused' | 'unresolved' | 'failed'
 export type EncryptionAction = 'unlock' | 'extend' | 'lock' | 'save' | 'rotate'
 

From ad42fd31bf2344e861c9c22bca2d2a472e17d152 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:54:30 +0200
Subject: [PATCH 47/86] fix: let a vault lock end every pending bucket key
 disclosure for good

---
 src/composables/useUserVault.test.ts | 25 +++++++++++++++++++++++++
 src/composables/useUserVault.ts      |  4 ++++
 src/lib/vault/bucketUnlock.test.ts   | 21 +++++++++++++++++++--
 src/lib/vault/bucketUnlock.ts        |  4 +++-
 4 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index bd7c68f9..85d42299 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -452,6 +452,31 @@ describe('useUserVault', () => {
     expect(afterUnlock()).toBe(false)
   })
 
+  it('stays locked when a read that began before the lock finishes after it', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    const lifetime = vault.whileUnlocked()
+    const decrypt = crypto.subtle.decrypt.bind(crypto.subtle)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const held = vi.spyOn(crypto.subtle, 'decrypt').mockImplementationOnce(async (...args) => {
+      await gate
+      return decrypt(...args)
+    })
+
+    const reading = vault.load()
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    vault.lock()
+    release()
+    await reading
+    held.mockRestore()
+
+    expect(vault.state.value).toBe('locked')
+    expect(vault.loading.value).toBe(false)
+    expect(lifetime()).toBe(false)
+    expect(vault.whileUnlocked()()).toBe(false)
+  })
+
   it('refuses a holder passphrase shorter than twelve characters', async () => {
     const { vault } = await boot()
     await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 254fd2c9..bb74ed1d 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -460,6 +460,10 @@ export function reapplyChange(
 
 function lock() {
   const scope = scopeKey
+  // Work started before the lock belongs to the unlocked vault: none of it may open it again.
+  generation += 1
+  inFlight = null
+  loading.value = false
   keyCheck = null
   masterKey = null
   providers.value = []
diff --git a/src/lib/vault/bucketUnlock.test.ts b/src/lib/vault/bucketUnlock.test.ts
index 5c190d53..f540bc07 100644
--- a/src/lib/vault/bucketUnlock.test.ts
+++ b/src/lib/vault/bucketUnlock.test.ts
@@ -58,11 +58,15 @@ function node(copies: unknown[], unlock: () => Response | Promise<Response>) {
 
 function vault(keyIds = [vector.key_id]) {
   const order: string[] = []
-  const lifetime = { open: true }
+  // `epoch` grows with every lock, as the vault generation does.
+  const lifetime = { open: true, epoch: 0 }
   return {
     order,
     lifetime,
-    whileUnlocked: () => () => lifetime.open,
+    whileUnlocked: () => {
+      const epoch = lifetime.epoch
+      return () => lifetime.open && lifetime.epoch === epoch
+    },
     checkKey: vi.fn(async () => {
       order.push('check')
       return 'matches'
@@ -138,6 +142,19 @@ describe('bucket unlock from the browser', () => {
     expect(sent.filter((call) => call.method === 'POST')).toHaveLength(0)
   })
 
+  it('stays cancelled when the vault is locked and opened again during the directory check', async () => {
+    const sent = node([COPY], UNLOCKED)
+    const keys = vault()
+    keys.checkKey.mockImplementation(async () => {
+      keys.lifetime.epoch += 1
+      return 'matches'
+    })
+
+    await expect(unlockWithVault(TARGET, keys, always)).rejects.toThrow(VaultClosedError)
+
+    expect(sent).toHaveLength(0)
+  })
+
   it('reports an unknown outcome once and does not send the key again', async () => {
     const sent = node([COPY], () => Promise.reject(new TypeError('network down')))
 
diff --git a/src/lib/vault/bucketUnlock.ts b/src/lib/vault/bucketUnlock.ts
index 16dcb824..4122b5bc 100644
--- a/src/lib/vault/bucketUnlock.ts
+++ b/src/lib/vault/bucketUnlock.ts
@@ -104,13 +104,15 @@ export async function unlockWithVault(
   vault: UnlockVault,
   current: () => boolean,
 ): Promise<UnlockOutcome> {
-  const ownKey = await vault.checkKey()
+  // Taken before the first await: a lock at any later point ends this unlock for good.
   const vaultOpen = vault.whileUnlocked()
   const guard = () => {
     if (!current()) throw new UnlockStaleError()
     if (!vaultOpen()) throw new VaultClosedError()
   }
   guard()
+  const ownKey = await vault.checkKey()
+  guard()
   const { bucketId, generation } = target.context
   const response = await getMyCopies(target.bucket, generation, target.client)
   guard()

From 5d17086d3303d497b969729f178fd85341749870 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:57:29 +0200
Subject: [PATCH 48/86] fix: give up a bucket access probe that does not answer
 in time

---
 src/composables/s3/objects.ts   | 20 ++++++++++++++++----
 src/composables/s3/read.test.ts | 22 +++++++++++++++++++++-
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/src/composables/s3/objects.ts b/src/composables/s3/objects.ts
index b03f25cf..89f844ff 100644
--- a/src/composables/s3/objects.ts
+++ b/src/composables/s3/objects.ts
@@ -854,17 +854,29 @@ async function fetchObject(
   return response
 }
 
+const PROBE_TIMEOUT_MS = 10_000
+
 // Reads one byte through a signed URL, so a locked bucket is seen before a viewer or a
-// download is offered. A failed or unclear probe never blocks; the viewer reports it.
-export async function probeObjectAccess(url: string): Promise<'open' | 'locked' | 'unknown'> {
-  if (!/^https?:/i.test(url)) return 'unknown'
+// download is offered. A failed, cancelled, slow or unclear probe never blocks: `unknown`.
+export async function probeObjectAccess(
+  url: string,
+  signal?: AbortSignal,
+): Promise<'open' | 'locked' | 'unknown'> {
+  if (!/^https?:/i.test(url) || signal?.aborted) return 'unknown'
+  const controller = new AbortController()
+  const stop = () => controller.abort()
+  const timer = globalThis.setTimeout(stop, PROBE_TIMEOUT_MS)
+  signal?.addEventListener('abort', stop, { once: true })
   try {
-    const response = await fetch(url, { headers: { Range: 'bytes=0-0' } })
+    const response = await fetch(url, { headers: { Range: 'bytes=0-0' }, signal: controller.signal })
     void response.body?.cancel().catch(() => undefined)
     if (response.status === 403 && response.headers.get(BUCKET_LOCKED_HEADER) === 'true') return 'locked'
     return response.ok ? 'open' : 'unknown'
   } catch {
     return 'unknown'
+  } finally {
+    globalThis.clearTimeout(timer)
+    signal?.removeEventListener('abort', stop)
   }
 }
 
diff --git a/src/composables/s3/read.test.ts b/src/composables/s3/read.test.ts
index 2b720846..35362074 100644
--- a/src/composables/s3/read.test.ts
+++ b/src/composables/s3/read.test.ts
@@ -30,7 +30,7 @@ describe('object reads', () => {
     const fetch = vi.fn().mockResolvedValue(new Response('', { status: 403, headers: { 'x-aruna-bucket-locked': 'true' } }))
     vi.stubGlobal('fetch', fetch)
     expect(await probeObjectAccess('https://s3.example/object')).toBe('locked')
-    expect(fetch.mock.calls[0][1]).toEqual({ headers: { Range: 'bytes=0-0' } })
+    expect(fetch.mock.calls[0][1]).toMatchObject({ headers: { Range: 'bytes=0-0' } })
 
     vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('x', { status: 206 })))
     expect(await probeObjectAccess('https://s3.example/object')).toBe('open')
@@ -38,4 +38,24 @@ describe('object reads', () => {
     expect(await probeObjectAccess('https://s3.example/object')).toBe('unknown')
     expect(await probeObjectAccess('blob:local')).toBe('unknown')
   })
+
+  it('gives up a silent probe after its time limit and when its caller cancels it', async () => {
+    const silent = vi.fn((_url: string, init: RequestInit) =>
+      new Promise<Response>((_, reject) => init.signal?.addEventListener('abort', () => reject(new Error('aborted')))),
+    )
+    vi.stubGlobal('fetch', silent)
+    vi.useFakeTimers()
+    try {
+      const slow = probeObjectAccess('https://s3.example/object')
+      await vi.advanceTimersByTimeAsync(10_000)
+      expect(await slow).toBe('unknown')
+
+      const caller = new AbortController()
+      const cancelled = probeObjectAccess('https://s3.example/object', caller.signal)
+      caller.abort()
+      expect(await cancelled).toBe('unknown')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
 })

From 122008d659ba3813249fa6e5f4bdee8228e5bd59 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:57:51 +0200
Subject: [PATCH 49/86] fix: bind preview access checks and downloads to the
 preview that started them

---
 src/components/preview/PreviewBody.vue   | 18 +++++++---
 src/composables/useObjectPreview.test.ts | 40 +++++++++++++++++++--
 src/composables/useObjectPreview.ts      | 45 +++++++++++++++++-------
 3 files changed, 85 insertions(+), 18 deletions(-)

diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 0c3e0a02..314a0212 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -58,9 +58,8 @@ const preview = useObjectPreview()
 const isHtml = computed(() =>
   /\.x?html?$/i.test(props.name) || (props.contentType ?? '').toLowerCase().startsWith('text/html'))
 
-function reload() {
-  if (!props.objectKey) return
-  const target = {
+function shownTarget() {
+  return {
     bucket: props.bucket,
     key: props.objectKey,
     size: props.size,
@@ -68,6 +67,11 @@ function reload() {
     nodeId: props.nodeId,
     versionId: props.versionId ?? undefined,
   }
+}
+
+function reload() {
+  if (!props.objectKey) return
+  const target = shownTarget()
   void preview.load(target)
   // After load(): its reset() would drop an earlier-started probe.
   if (props.probeReference && !props.referencedFrom) void preview.probeReferenced(target)
@@ -82,8 +86,11 @@ watch(
   { immediate: true },
 )
 
+// A download belongs to the preview it was started from; a newer one drops its result.
 async function download() {
   if (!props.objectKey) return
+  const id = preview.loadToken()
+  const target = shownTarget()
   try {
     const url =
       preview.directUrl.value
@@ -94,7 +101,9 @@ async function download() {
         props.versionId ?? undefined,
         props.name,
       ))
-    if (!(await preview.checkAccess(url))) return
+    if (!preview.isCurrent(id)) return
+    const open = await preview.checkAccess(url, id, target)
+    if (!preview.isCurrent(id) || !open) return
     // In the document, not detached: a detached anchor is ignored by some
     // browsers, and the name travels in the response's Content-Disposition.
     const anchor = document.createElement('a')
@@ -105,6 +114,7 @@ async function download() {
     anchor.click()
     anchor.remove()
   } catch (err) {
+    if (!preview.isCurrent(id)) return
     preview.errorMessage.value = s3ErrorMessage(err)
     preview.status.value = 'error'
   }
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 042df5fd..525ef8e6 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -126,9 +126,9 @@ describe('preview of a locked bucket', () => {
     await preview.load({ ...TARGET, key: 'paper.pdf' })
     expect(preview.status.value).toBe('ready')
     probeAccess.mockResolvedValueOnce('locked')
-    expect(await preview.checkAccess('https://b.test/presigned')).toBe(false)
+    expect(await preview.checkAccess('https://b.test/presigned', preview.loadToken())).toBe(false)
     expect(preview.status.value).toBe('locked')
-    expect(probeAccess).toHaveBeenCalledWith('https://b.test/presigned')
+    expect(probeAccess).toHaveBeenCalledWith('https://b.test/presigned', expect.any(AbortSignal))
   })
 
   it('loads again once the node confirms the bucket is plain, and keeps an unreported key state unknown', async () => {
@@ -147,4 +147,40 @@ describe('preview of a locked bucket', () => {
     expect(preview.status.value).toBe('ready')
     expect(preview.text.value).toBe('plain again')
   })
+
+  it('cancels the probe of an older load and never gives its URL to a newer preview', async () => {
+    let answer!: (value: string) => void
+    probeAccess.mockImplementationOnce(() => new Promise((resolve) => (answer = resolve)))
+    getObjectText.mockResolvedValueOnce('newer text')
+    const preview = useObjectPreview()
+
+    const media = preview.load({ ...TARGET, key: 'clip.mp4' })
+    await vi.waitFor(() => expect(probeAccess).toHaveBeenCalled())
+    await preview.load(TARGET)
+    answer('open')
+    await media
+
+    const signal = probeAccess.mock.calls[0][1] as AbortSignal
+    expect(signal.aborted).toBe(true)
+    expect(preview.text.value).toBe('newer text')
+    expect(preview.directUrl.value).toBeNull()
+    expect(preview.status.value).toBe('ready')
+  })
+
+  it('lets a check from an older preview neither lock nor link the newer one', async () => {
+    const preview = useObjectPreview()
+    await preview.load({ ...TARGET, key: 'clip.mp4' })
+    const older = preview.loadToken()
+    getObjectText.mockResolvedValueOnce('other text')
+    await preview.load({ ...TARGET, bucket: 'other', key: 'b.txt' })
+    probeAccess.mockResolvedValueOnce('locked')
+
+    expect(await preview.checkAccess('https://b.test/presigned', older, TARGET)).toBe(false)
+    expect(preview.status.value).toBe('ready')
+    expect(preview.lockedLink.value).toBeNull()
+
+    probeAccess.mockResolvedValueOnce('locked')
+    expect(await preview.checkAccess('https://b.test/presigned', preview.loadToken(), TARGET)).toBe(false)
+    expect(preview.lockedLink.value).toMatchObject({ params: { bucketId: 'reef' } })
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index cf72db38..8f152d7a 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -117,6 +117,7 @@ export function useObjectPreview() {
   const lockCheck = ref<'idle' | 'checking' | 'still' | 'unknown' | 'failed'>('idle')
   const lockedTarget = shallowRef<PreviewTarget | null>(null)
   let currentTarget: PreviewTarget | null = null
+  let probe: AbortController | null = null
   let loadId = 0
   const kind = ref<PreviewKind>('download')
   const language = ref<string | undefined>(undefined)
@@ -132,6 +133,8 @@ export function useObjectPreview() {
   let referenceProbeId = 0
 
   function reset() {
+    probe?.abort()
+    probe = null
     if (objectUrl.value) URL.revokeObjectURL(objectUrl.value)
     status.value = 'idle'
     kind.value = 'download'
@@ -167,19 +170,31 @@ export function useObjectPreview() {
     }
   }
 
-  /** Switches the current preview to waiting for a bucket unlock. */
-  function markLocked() {
-    if (!currentTarget) return
-    lockedTarget.value = currentTarget
+  /** Switches the preview to waiting for a bucket unlock of `target`. */
+  function markLocked(target = currentTarget) {
+    if (!target) return
+    lockedTarget.value = target
     status.value = 'locked'
   }
 
-  /** False when a newer load took over, or when the bucket turned out to be locked. */
-  async function checkAccess(url: string, id = loadId): Promise<boolean> {
-    const access = await s3.probeAccess(url)
-    if (id !== loadId) return false
-    if (access === 'locked') markLocked()
-    return access !== 'locked'
+  /** The load a request starts in; `isCurrent` turns false once a newer load or a reset begins. */
+  const loadToken = () => loadId
+  const isCurrent = (id: number) => id === loadId
+
+  // False when a newer load took over, or when the bucket of `target` turned out to be locked.
+  // A newer probe cancels an older one, which then reads as unclear and blocks nothing.
+  async function checkAccess(url: string, id: number, target = currentTarget): Promise<boolean> {
+    probe?.abort()
+    const controller = new AbortController()
+    probe = controller
+    try {
+      const access = await s3.probeAccess(url, controller.signal)
+      if (id !== loadId) return false
+      if (access === 'locked') markLocked(target)
+      return access !== 'locked'
+    } finally {
+      if (probe === controller) probe = null
+    }
   }
 
   async function fallbackDownload(target: PreviewTarget, cap: number, actual: number, id: number) {
@@ -187,7 +202,9 @@ export function useObjectPreview() {
     sizeNote.value = `This file is ${formatBytes(actual)}, above the ${formatBytes(cap)} preview limit.`
     try {
       const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
-      if (id !== loadId || !(await checkAccess(url, id))) return
+      if (id !== loadId) return
+      const open = await checkAccess(url, id, target)
+      if (id !== loadId || !open) return
       directUrl.value = url
       status.value = 'ready'
     } catch (err) {
@@ -210,7 +227,9 @@ export function useObjectPreview() {
       if (classified.kind === 'media' || classified.kind === 'pdf' || classified.kind === 'download') {
         if (classified.kind === 'media') mediaKind.value = mediaSubtype(target)
         const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
-        if (id !== loadId || !(await checkAccess(url, id))) return
+        if (id !== loadId) return
+        const open = await checkAccess(url, id, target)
+        if (id !== loadId || !open) return
         directUrl.value = url
         status.value = 'ready'
         return
@@ -298,6 +317,8 @@ export function useObjectPreview() {
     recheck,
     markLocked,
     checkAccess,
+    loadToken,
+    isCurrent,
     kind,
     language,
     mediaKind,

From 9c75777febdccd10b63a019ffd7bd882f4fe040a Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:58:14 +0200
Subject: [PATCH 50/86] fix: check for a bucket lock when a media player cannot
 read its file

---
 src/components/preview/MediaPreview.test.ts | 18 ++++++++++++++++++
 src/components/preview/MediaPreview.vue     |  5 ++++-
 src/components/preview/PreviewBody.vue      |  7 +++++++
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 src/components/preview/MediaPreview.test.ts

diff --git a/src/components/preview/MediaPreview.test.ts b/src/components/preview/MediaPreview.test.ts
new file mode 100644
index 00000000..aed55de9
--- /dev/null
+++ b/src/components/preview/MediaPreview.test.ts
@@ -0,0 +1,18 @@
+import * as VueRuntime from 'vue'
+import { describe, expect, it, vi } from 'vitest'
+import { compileClientComponent, element, mountApp } from '@/test/clientRender'
+
+const media = compileClientComponent(new URL('./MediaPreview.vue', import.meta.url), { vue: VueRuntime })
+
+describe('media preview', () => {
+  it('reports a failed read of the player', async () => {
+    for (const mediaKind of ['video', 'audio']) {
+      const onFailed = vi.fn()
+      const { root } = await mountApp(media, { props: { url: 'https://b.test/presigned', mediaKind, onFailed } })
+
+      ;(element(root, (node) => node.tag === mediaKind).props.onError as () => void)()
+
+      expect(onFailed).toHaveBeenCalledOnce()
+    }
+  })
+})
diff --git a/src/components/preview/MediaPreview.vue b/src/components/preview/MediaPreview.vue
index 77a2749d..6c690353 100644
--- a/src/components/preview/MediaPreview.vue
+++ b/src/components/preview/MediaPreview.vue
@@ -1,5 +1,7 @@
 <script setup lang="ts">
 defineProps<{ url: string; mediaKind: 'video' | 'audio'; name?: string }>()
+// The player reports a failed read, so the preview can check whether the bucket locked.
+const emit = defineEmits<{ (e: 'failed'): void }>()
 </script>
 
 <template>
@@ -10,7 +12,8 @@ defineProps<{ url: string; mediaKind: 'video' | 'audio'; name?: string }>()
       controls
       preload="metadata"
       class="max-h-[68vh] w-full max-w-full rounded"
+      @error="emit('failed')"
     />
-    <audio v-else :src="url" controls preload="metadata" class="w-full" />
+    <audio v-else :src="url" controls preload="metadata" class="w-full" @error="emit('failed')" />
   </div>
 </template>
diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 314a0212..7596c093 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -119,6 +119,12 @@ async function download() {
     preview.status.value = 'error'
   }
 }
+
+// A player that cannot read its URL is waiting for a key only when a probe confirms the lock.
+async function mediaFailed() {
+  const url = preview.directUrl.value
+  if (url) await preview.checkAccess(url, preview.loadToken())
+}
 </script>
 
 <template>
@@ -238,6 +244,7 @@ async function download() {
         :url="preview.directUrl.value"
         :media-kind="preview.mediaKind.value"
         :name="props.name"
+        @failed="mediaFailed"
       />
       <PdfPreview
         v-else-if="preview.kind.value === 'pdf' && preview.directUrl.value"

From fb0a600471eb8c753852ba6a47900be9f3da2c06 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 13:58:25 +0200
Subject: [PATCH 51/86] fix: name the Check again button and the grants that
 survive lost admin rights

---
 src/docs/v1.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/docs/v1.ts b/src/docs/v1.ts
index 0265e639..808de021 100644
--- a/src/docs/v1.ts
+++ b/src/docs/v1.ts
@@ -809,7 +809,7 @@ export const docsTopics: DocsTopic[] = [
           'Vault-locked: only key holders unlock the bucket, and a node restart locks it again.',
         ],
         paragraphs: [
-          'Writes, listing and HEAD work while a bucket is locked. Downloads, previews and jobs that need its content wait for an unlock; a preview links to the Encryption tab and loads again once the bucket is unlocked. The content hash stays visible in metadata, so equal files are still recognisable.',
+          'Writes, listing and HEAD work while a bucket is locked. Downloads, previews and jobs that need its content wait for an unlock; a preview links to the Encryption tab, and its Check again button loads it once the node reports the bucket unlocked. The content hash stays visible in metadata, so equal files are still recognisable.',
           'S3 clients see an encrypted bucket like SSE-S3 (`x-amz-server-side-encryption: AES256`) and send no key.',
         ],
       },
@@ -817,7 +817,7 @@ export const docsTopics: DocsTopic[] = [
         title: 'Key holders and recovery',
         icon: 'Users',
         paragraphs: [
-          'Key holders are the bucket creator, the group admins and users granted explicitly. Each one has a copy of the bucket key, sealed to the key in their vault. A user who loses group-admin rights loses the right to unlock at once.',
+          'Key holders are the bucket creator, the group admins and users granted explicitly. Each one has a copy of the bucket key, sealed to the key in their vault. A user who loses group-admin rights loses the implicit right to unlock at once; a creator and explicit grants stay valid.',
           'A vault-locked bucket needs a recovery code or two ready key holders. Removing a key holder that breaks this rule needs a confirmation, and removing a key holder does not erase copies they already made.',
           'Your vault passphrase needs at least 12 characters, because the vault opens bucket keys. Set it up under [Settings](page:settings), Provider keys.',
         ],

From ecb7d65c67d863cc1d1e7f27645829d75b90ca96 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:15:52 +0200
Subject: [PATCH 52/86] fix: read a preview again when its bucket, node or
 session changes

---
 src/components/preview/PreviewBody.test.ts | 127 +++++++++++++++++++++
 src/components/preview/PreviewBody.vue     |  15 ++-
 src/composables/useObjectPreview.test.ts   |  11 ++
 src/composables/useObjectPreview.ts        |  20 +++-
 4 files changed, 170 insertions(+), 3 deletions(-)
 create mode 100644 src/components/preview/PreviewBody.test.ts

diff --git a/src/components/preview/PreviewBody.test.ts b/src/components/preview/PreviewBody.test.ts
new file mode 100644
index 00000000..fb421ba7
--- /dev/null
+++ b/src/components/preview/PreviewBody.test.ts
@@ -0,0 +1,127 @@
+import { defineComponent, h, reactive, ref } from 'vue'
+import * as VueRuntime from 'vue'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { button, click, compileClientComponent, flush, mountApp, moduleDefault } from '@/test/clientRender'
+
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+
+const load = vi.fn()
+const urlFor = vi.fn()
+const checkAccess = vi.fn()
+const downloadUrl = vi.fn()
+let token = 1
+const preview = {
+  status: ref('idle'),
+  kind: ref('download'),
+  language: ref(undefined),
+  mediaKind: ref('video'),
+  delimiter: ref(','),
+  text: ref(null),
+  objectUrl: ref(null),
+  directUrl: ref<string | null>(null),
+  errorMessage: ref(null),
+  corsBlocked: ref(false),
+  sizeNote: ref(null),
+  referenced: ref(false),
+  lockCheck: ref('idle'),
+  lockedLink: ref(null),
+  sessionKey: ref('session-1'),
+  load,
+  reset: vi.fn(),
+  probeReferenced: vi.fn(),
+  recheck: vi.fn(),
+  markLocked: vi.fn(),
+  checkAccess,
+  urlFor,
+  loadToken: () => token,
+  isCurrent: (id: number) => id === token,
+}
+
+const body = compileClientComponent(new URL('./PreviewBody.vue', import.meta.url), {
+  vue: VueRuntime,
+  'vue-router': { RouterLink: Slotted('a') },
+  '@lucide/vue': new Proxy({}, { get: () => Slotted('i') }),
+  '@/lib/chunk-recovery': { asyncChunkError: () => undefined },
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/ErrorPanel.vue': moduleDefault(Slotted('div')),
+  '@/components/ui/Notice.vue': moduleDefault(Slotted('aside')),
+  '@/components/ui/Spinner.vue': moduleDefault(Slotted('span')),
+  '@/composables/useObjectPreview': { useObjectPreview: () => preview },
+  '@/composables/useS3': { useS3: () => ({ downloadUrl }), s3ErrorMessage: (error: unknown) => String(error) },
+  './TextPreview.vue': moduleDefault(Slotted('div')),
+  './HtmlPreview.vue': moduleDefault(Slotted('div')),
+  './MarkdownPreview.vue': moduleDefault(Slotted('div')),
+  './CsvPreview.vue': moduleDefault(Slotted('div')),
+  './ImagePreview.vue': moduleDefault(Slotted('div')),
+  './MediaPreview.vue': moduleDefault(Slotted('div')),
+  './PdfPreview.vue': moduleDefault(Slotted('div')),
+  './DownloadCard.vue': moduleDefault(Slotted('div')),
+})
+
+const shown = reactive({ active: true, bucket: 'reef', objectKey: 'a.txt', name: 'a.txt', nodeId: null as string | null })
+const Host = defineComponent(() => () => h(body, { ...shown }))
+const anchor = { href: '', download: '', rel: '', click: vi.fn(), remove: vi.fn() }
+
+beforeEach(() => {
+  Object.assign(shown, { active: true, bucket: 'reef', objectKey: 'a.txt', name: 'a.txt', nodeId: null })
+  preview.sessionKey.value = 'session-1'
+  token = 1
+  load.mockReset()
+  urlFor.mockReset().mockReturnValue(null)
+  checkAccess.mockReset().mockResolvedValue(true)
+  downloadUrl.mockReset().mockResolvedValue('https://signed/fresh')
+  anchor.click.mockReset()
+  vi.stubGlobal('document', { createElement: () => anchor, body: { append: vi.fn() } })
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('preview body', () => {
+  it('reads the object again when its bucket, node or session changes', async () => {
+    await mountApp(Host)
+
+    shown.bucket = 'other'
+    await flush()
+    shown.nodeId = 'node-b'
+    await flush()
+    preview.sessionKey.value = 'session-2'
+    await flush()
+
+    expect(load.mock.calls.map(([target]) => [target.bucket, target.nodeId ?? null])).toEqual([
+      ['reef', null],
+      ['other', null],
+      ['other', 'node-b'],
+      ['other', 'node-b'],
+    ])
+  })
+
+  it('downloads only a URL signed for the object it shows', async () => {
+    const { root } = await mountApp(Host)
+    shown.bucket = 'other'
+    await flush()
+
+    await click(button(root, 'Download'))
+
+    expect(urlFor).toHaveBeenCalledWith(expect.objectContaining({ bucket: 'other', key: 'a.txt' }))
+    expect(downloadUrl.mock.calls[0].slice(0, 2)).toEqual(['other', 'a.txt'])
+    expect(anchor.href).toBe('https://signed/fresh')
+    expect(anchor.click).toHaveBeenCalledOnce()
+  })
+
+  it('drops a download whose preview changed while its URL was signed', async () => {
+    let sign!: (url: string) => void
+    downloadUrl.mockReturnValueOnce(new Promise((resolve) => (sign = resolve)))
+    const { root } = await mountApp(Host)
+
+    const started = click(button(root, 'Download'))
+    token = 2
+    sign('https://signed/old')
+    await started
+
+    expect(checkAccess).not.toHaveBeenCalled()
+    expect(anchor.click).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 7596c093..7bf6a57e 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -77,8 +77,19 @@ function reload() {
   if (props.probeReference && !props.referencedFrom) void preview.probeReferenced(target)
 }
 
+// Any change of the object, its bucket or node, or the account and session reads it again.
 watch(
-  () => [props.active, props.objectKey, props.versionId] as const,
+  () =>
+    [
+      props.active,
+      props.bucket,
+      props.nodeId ?? null,
+      props.objectKey,
+      props.versionId ?? null,
+      props.size,
+      props.contentType,
+      preview.sessionKey.value,
+    ] as const,
   ([active]) => {
     if (active && props.objectKey) reload()
     else preview.reset()
@@ -93,7 +104,7 @@ async function download() {
   const target = shownTarget()
   try {
     const url =
-      preview.directUrl.value
+      preview.urlFor(target)
       ?? (await s3.downloadUrl(
         props.bucket,
         props.objectKey,
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 525ef8e6..78f01e25 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -183,4 +183,15 @@ describe('preview of a locked bucket', () => {
     expect(await preview.checkAccess('https://b.test/presigned', preview.loadToken(), TARGET)).toBe(false)
     expect(preview.lockedLink.value).toMatchObject({ params: { bucketId: 'reef' } })
   })
+
+  it('hands out its signed URL only for the object it was signed for', async () => {
+    const preview = useObjectPreview()
+    const clip = { ...TARGET, key: 'clip.mp4' }
+    await preview.load(clip)
+
+    expect(preview.urlFor(clip)).toBe('https://b.test/presigned')
+    expect(preview.urlFor({ ...clip, bucket: 'other' })).toBeNull()
+    expect(preview.urlFor({ ...clip, nodeId: 'node-c' })).toBeNull()
+    expect(preview.urlFor({ ...clip, versionId: 'v2' })).toBeNull()
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 8f152d7a..2edf43cb 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -3,7 +3,7 @@ import { getBucketEncryption } from '@/lib/api'
 import { bucketUnlockLink, keyGenerations } from '@/lib/bucketEncryption'
 import { formatBytes } from '@/lib/utils'
 import { hasReferenceMetadata } from '@/lib/references'
-import { authToken } from './aruna/state'
+import { authToken, sessionEpoch, userInfo } from './aruna/state'
 import { isS3BucketLockedError } from './s3/errors'
 import { localNodeId, nodeApiBase } from './s3/endpoints'
 import { s3ErrorMessage, useS3 } from './useS3'
@@ -131,6 +131,10 @@ export function useObjectPreview() {
   const sizeNote = ref<string | null>(null)
   const referenced = ref(false)
   let referenceProbeId = 0
+  /** Account, session and S3 group a preview is read under; a change means reading again. */
+  const sessionKey = computed(() =>
+    [sessionEpoch.value, userInfo.value?.user.user_id ?? '', s3.activeContext?.value?.groupId ?? ''].join('\u0000'),
+  )
 
   function reset() {
     probe?.abort()
@@ -177,6 +181,18 @@ export function useObjectPreview() {
     status.value = 'locked'
   }
 
+  /** The signed URL of the current load, only when it was signed for `target`. */
+  function urlFor(target: PreviewTarget): string | null {
+    const shown = currentTarget
+    if (!shown || !directUrl.value) return null
+    const same =
+      shown.bucket === target.bucket &&
+      shown.key === target.key &&
+      (shown.nodeId ?? null) === (target.nodeId ?? null) &&
+      (shown.versionId ?? null) === (target.versionId ?? null)
+    return same ? directUrl.value : null
+  }
+
   /** The load a request starts in; `isCurrent` turns false once a newer load or a reset begins. */
   const loadToken = () => loadId
   const isCurrent = (id: number) => id === loadId
@@ -319,6 +335,8 @@ export function useObjectPreview() {
     checkAccess,
     loadToken,
     isCurrent,
+    sessionKey,
+    urlFor,
     kind,
     language,
     mediaKind,

From 6c835cb2a4f0e6a5ec0d65c67be24e02355b3569 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:16:22 +0200
Subject: [PATCH 53/86] fix: end pending preview work when the preview is
 disposed

---
 src/composables/useObjectPreview.test.ts | 14 ++++++++++++++
 src/composables/useObjectPreview.ts      |  5 ++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 78f01e25..ceac230c 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { effectScope } from 'vue'
 import * as Api from '@/lib/api'
 import type { BucketEncryptionResponse, BucketUnlockStatus } from '@/lib/api'
 import { useObjectPreview } from './useObjectPreview'
@@ -194,4 +195,17 @@ describe('preview of a locked bucket', () => {
     expect(preview.urlFor({ ...clip, nodeId: 'node-c' })).toBeNull()
     expect(preview.urlFor({ ...clip, versionId: 'v2' })).toBeNull()
   })
+
+  it('ends every pending request when the preview is disposed', async () => {
+    const scope = effectScope()
+    const preview = scope.run(() => useObjectPreview())!
+    await preview.load({ ...TARGET, key: 'clip.mp4' })
+    const token = preview.loadToken()
+
+    scope.stop()
+
+    expect(preview.isCurrent(token)).toBe(false)
+    expect(preview.status.value).toBe('idle')
+    expect(await preview.checkAccess('https://b.test/presigned', token)).toBe(false)
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 2edf43cb..a4f01282 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -1,4 +1,4 @@
-import { computed, ref, shallowRef } from 'vue'
+import { computed, getCurrentScope, onScopeDispose, ref, shallowRef } from 'vue'
 import { getBucketEncryption } from '@/lib/api'
 import { bucketUnlockLink, keyGenerations } from '@/lib/bucketEncryption'
 import { formatBytes } from '@/lib/utils'
@@ -326,6 +326,9 @@ export function useObjectPreview() {
     }
   }
 
+  // A disposed preview starts nothing new and lets no pending work finish into it.
+  if (getCurrentScope()) onScopeDispose(reset)
+
   return {
     status,
     lockCheck,

From e2a4fdee8da2119f85c2c34761a48bd38bd51d0a Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:16:58 +0200
Subject: [PATCH 54/86] fix: never let a cancelled or earlier access probe undo
 a confirmed lock

---
 src/composables/useObjectPreview.test.ts | 31 ++++++++++++++++++++++++
 src/composables/useObjectPreview.ts      | 29 +++++++++++-----------
 2 files changed, 45 insertions(+), 15 deletions(-)

diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index ceac230c..5b9b1bcf 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -208,4 +208,35 @@ describe('preview of a locked bucket', () => {
     expect(preview.status.value).toBe('idle')
     expect(await preview.checkAccess('https://b.test/presigned', token)).toBe(false)
   })
+
+  it('keeps a lock one probe confirmed when an earlier probe of the same load answers later', async () => {
+    let first!: (value: string) => void
+    probeAccess.mockImplementationOnce(() => new Promise((resolve) => (first = resolve)))
+    const preview = useObjectPreview()
+
+    const media = preview.load({ ...TARGET, key: 'clip.mp4' })
+    await vi.waitFor(() => expect(probeAccess).toHaveBeenCalledTimes(1))
+    probeAccess.mockResolvedValueOnce('locked')
+    expect(await preview.checkAccess('https://b.test/presigned', preview.loadToken())).toBe(false)
+    first('open')
+    await media
+
+    expect(preview.status.value).toBe('locked')
+    expect(preview.directUrl.value).toBeNull()
+  })
+
+  it('never reads a cancelled probe as permission', async () => {
+    probeAccess.mockImplementationOnce(
+      (_url: string, signal: AbortSignal) =>
+        new Promise((resolve) => signal.addEventListener('abort', () => resolve('unknown'))),
+    )
+    const preview = useObjectPreview()
+    await preview.load(TARGET)
+    const token = preview.loadToken()
+
+    const check = preview.checkAccess('https://b.test/presigned', token)
+    preview.reset()
+
+    expect(await check).toBe(false)
+  })
 })
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index a4f01282..57bf625b 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -117,7 +117,8 @@ export function useObjectPreview() {
   const lockCheck = ref<'idle' | 'checking' | 'still' | 'unknown' | 'failed'>('idle')
   const lockedTarget = shallowRef<PreviewTarget | null>(null)
   let currentTarget: PreviewTarget | null = null
-  let probe: AbortController | null = null
+  // One controller per load: a reset cancels every probe of the load it ends.
+  let probes = new AbortController()
   let loadId = 0
   const kind = ref<PreviewKind>('download')
   const language = ref<string | undefined>(undefined)
@@ -137,8 +138,8 @@ export function useObjectPreview() {
   )
 
   function reset() {
-    probe?.abort()
-    probe = null
+    probes.abort()
+    probes = new AbortController()
     if (objectUrl.value) URL.revokeObjectURL(objectUrl.value)
     status.value = 'idle'
     kind.value = 'download'
@@ -197,20 +198,18 @@ export function useObjectPreview() {
   const loadToken = () => loadId
   const isCurrent = (id: number) => id === loadId
 
-  // False when a newer load took over, or when the bucket of `target` turned out to be locked.
-  // A newer probe cancels an older one, which then reads as unclear and blocks nothing.
+  // True only while the load is current and no probe of it confirmed a lock. A cancelled probe
+  // is never permission; a slow one (`unknown` after its time limit) blocks nothing.
   async function checkAccess(url: string, id: number, target = currentTarget): Promise<boolean> {
-    probe?.abort()
-    const controller = new AbortController()
-    probe = controller
-    try {
-      const access = await s3.probeAccess(url, controller.signal)
-      if (id !== loadId) return false
-      if (access === 'locked') markLocked(target)
-      return access !== 'locked'
-    } finally {
-      if (probe === controller) probe = null
+    if (id !== loadId) return false
+    const signal = probes.signal
+    const access = await s3.probeAccess(url, signal)
+    if (signal.aborted || id !== loadId) return false
+    if (access === 'locked') {
+      markLocked(target)
+      return false
     }
+    return status.value !== 'locked'
   }
 
   async function fallbackDownload(target: PreviewTarget, cap: number, actual: number, id: number) {

From 0400cc6eaa00e91e97e14077d23a5eb230b1ef24 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:17:40 +0200
Subject: [PATCH 55/86] fix: drop the error of a vault cache read that a newer
 read overtook

---
 src/composables/useUserVault.test.ts | 25 ++++++++++++++++++++++++-
 src/composables/useUserVault.ts      |  6 +++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 85d42299..e4f7430c 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -50,6 +50,7 @@ const publishUserKey = vi.fn(async (request: { key_id: string; public_key: strin
 })
 
 // The remembered key and the cached heads, as the browser's IndexedDB would keep them.
+const cachedLoads = vi.fn(async (scope: string): Promise<FakeHead[] | null> => cached.get(scope) ?? null)
 const remembered = new Map<string, CryptoKey>()
 const cached = new Map<string, FakeHead[]>()
 const SCOPE = assistantChatScopeKey({ apiBaseUrl: 'https://node.test/api/v1', realmId: 'r-1', userId: 'u-1' })
@@ -84,7 +85,7 @@ vi.mock('@/lib/vault/keyStore', () => ({
     remove: async (scope: string) => {
       remembered.delete(scope)
     },
-    loadHeads: async (scope: string) => cached.get(scope) ?? null,
+    loadHeads: (scope: string) => cachedLoads(scope),
     saveHeads: async (scope: string, heads: FakeHead[]) => {
       if (heads.length) cached.set(scope, heads)
       else cached.delete(scope)
@@ -477,6 +478,28 @@ describe('useUserVault', () => {
     expect(vault.whileUnlocked()()).toBe(false)
   })
 
+  it('writes no error from a cache read that a lock and a newer read overtook', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    readVault.mockRejectedValueOnce(refused(503, 'vault_unavailable'))
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const loadHeads = cachedLoads.mockImplementationOnce(async (scope: string) => {
+      await gate
+      return cached.get(scope) ?? null
+    })
+
+    const old = vault.load()
+    await vi.waitFor(() => expect(loadHeads).toHaveBeenCalled())
+    vault.lock()
+    await vault.load()
+    release()
+    await old
+
+    expect(vault.error.value).toBeNull()
+    expect(vault.state.value).toBe('locked')
+  })
+
   it('refuses a holder passphrase shorter than twelve characters', async () => {
     const { vault } = await boot()
     await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index bb74ed1d..a15ea877 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -381,7 +381,11 @@ function load(): Promise<void> {
         loaded.value = true
         return
       }
-      if (vaultUnavailable(cause) && await loadCached(scope, run)) return
+      if (vaultUnavailable(cause)) {
+        const cached = await loadCached(scope, run)
+        // A lock or a newer read during the cache read owns the state now.
+        if (cached || run !== generation) return
+      }
       error.value = apiErrorMessage(cause)
     } finally {
       if (run === generation) {

From 1c3e95b97c901da331a98dd05d70926190adda09 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:18:33 +0200
Subject: [PATCH 56/86] fix: apply a vault reset only to the session that
 started it

---
 src/composables/useUserVault.test.ts | 17 +++++++++++++++++
 src/composables/useUserVault.ts      |  9 ++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index e4f7430c..231e1eec 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -500,6 +500,23 @@ describe('useUserVault', () => {
     expect(vault.state.value).toBe('locked')
   })
 
+  it('applies a reset only to the session that started it', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', false)
+    let finish!: () => void
+    deleteVault.mockImplementationOnce(() => new Promise<void>((resolve) => (finish = resolve)))
+
+    const resetting = vault.reset()
+    state.sessionEpoch.value += 1
+    await vault.load()
+    expect(vault.state.value).toBe('locked')
+    finish()
+    await resetting
+
+    expect(vault.state.value).toBe('locked')
+    expect(readVault).toHaveBeenCalledTimes(2)
+  })
+
   it('refuses a holder passphrase shorter than twelve characters', async () => {
     const { vault } = await boot()
     await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index a15ea877..3a6eef10 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -85,6 +85,8 @@ let generation = 0
 let requested = false
 let inFlight: Promise<void> | null = null
 let keyCheck: Promise<void> | null = null
+/** Grows with every account or session change, unlike `generation`, which a lock advances too. */
+let sessionGeneration = 0
 
 function client() {
   return { baseUrl: apiBaseUrl.value, token: authToken.value }
@@ -171,6 +173,7 @@ async function openProviders(current: VaultPayload, key: CryptoKey): Promise<Bro
 
 function clearLocal() {
   generation += 1
+  sessionGeneration += 1
   inFlight = null
   keyCheck = null
   payload = null
@@ -572,14 +575,18 @@ async function openUserKey(keyId: string): Promise<X25519Pair | null> {
 
 async function reset(): Promise<void> {
   const scope = scopeKey
+  const session = sessionGeneration
   await deleteVault(client())
+  // The deletion belongs to this account and session; another one keeps its own state.
+  if (session !== sessionGeneration) return
   payload = null
   masterKey = null
   providers.value = []
   state.value = 'absent'
   forgetKey(scope)
   // A save made at the same time on another holder outlives the delete.
-  await settle(scope, (await readVault(client())).heads)
+  const response = await readVault(client())
+  if (session === sessionGeneration) await settle(scope, response.heads)
 }
 
 async function saveProviders(next: BrowserProvider[]): Promise<void> {

From c626f5411e8288c797662b7f1347203c3527c791 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:19:41 +0200
Subject: [PATCH 57/86] fix: ignore viewer reports about a file the preview no
 longer shows

---
 src/components/preview/MediaPreview.test.ts |  2 +-
 src/components/preview/MediaPreview.vue     | 10 +++----
 src/components/preview/PdfPreview.test.ts   | 15 +++++++++-
 src/components/preview/PdfPreview.vue       | 17 +++++++----
 src/components/preview/PreviewBody.test.ts  | 32 +++++++++++++++++++--
 src/components/preview/PreviewBody.vue      | 12 +++++---
 6 files changed, 69 insertions(+), 19 deletions(-)

diff --git a/src/components/preview/MediaPreview.test.ts b/src/components/preview/MediaPreview.test.ts
index aed55de9..574ac93d 100644
--- a/src/components/preview/MediaPreview.test.ts
+++ b/src/components/preview/MediaPreview.test.ts
@@ -12,7 +12,7 @@ describe('media preview', () => {
 
       ;(element(root, (node) => node.tag === mediaKind).props.onError as () => void)()
 
-      expect(onFailed).toHaveBeenCalledOnce()
+      expect(onFailed).toHaveBeenCalledWith('https://b.test/presigned')
     }
   })
 })
diff --git a/src/components/preview/MediaPreview.vue b/src/components/preview/MediaPreview.vue
index 6c690353..f329106f 100644
--- a/src/components/preview/MediaPreview.vue
+++ b/src/components/preview/MediaPreview.vue
@@ -1,7 +1,7 @@
 <script setup lang="ts">
-defineProps<{ url: string; mediaKind: 'video' | 'audio'; name?: string }>()
-// The player reports a failed read, so the preview can check whether the bucket locked.
-const emit = defineEmits<{ (e: 'failed'): void }>()
+const props = defineProps<{ url: string; mediaKind: 'video' | 'audio'; name?: string }>()
+// The player reports which URL it failed to read, so the preview checks only its own file.
+const emit = defineEmits<{ (e: 'failed', url: string): void }>()
 </script>
 
 <template>
@@ -12,8 +12,8 @@ const emit = defineEmits<{ (e: 'failed'): void }>()
       controls
       preload="metadata"
       class="max-h-[68vh] w-full max-w-full rounded"
-      @error="emit('failed')"
+      @error="emit('failed', props.url)"
     />
-    <audio v-else :src="url" controls preload="metadata" class="w-full" @error="emit('failed')" />
+    <audio v-else :src="url" controls preload="metadata" class="w-full" @error="emit('failed', props.url)" />
   </div>
 </template>
diff --git a/src/components/preview/PdfPreview.test.ts b/src/components/preview/PdfPreview.test.ts
index b6b9bd42..361ac4f4 100644
--- a/src/components/preview/PdfPreview.test.ts
+++ b/src/components/preview/PdfPreview.test.ts
@@ -29,7 +29,20 @@ describe('pdf preview', () => {
     await mountApp(pdf, { props: { url: 'https://b.test/presigned', onLocked } })
     await flush()
 
-    expect(onLocked).toHaveBeenCalledOnce()
+    expect(onLocked).toHaveBeenCalledWith('https://b.test/presigned')
+  })
+
+  it('reports nothing once it is gone before its read answers', async () => {
+    let answer!: (response: Response) => void
+    vi.stubGlobal('fetch', vi.fn(() => new Promise<Response>((resolve) => (answer = resolve))))
+    const onLocked = vi.fn()
+
+    const { app } = await mountApp(pdf, { props: { url: 'https://b.test/presigned', onLocked } })
+    app.unmount()
+    answer(new Response('<Error/>', { status: 403, headers: { 'x-aruna-bucket-locked': 'true' } }))
+    await flush()
+
+    expect(onLocked).not.toHaveBeenCalled()
   })
 
   it('keeps an ordinary refusal a loading failure', async () => {
diff --git a/src/components/preview/PdfPreview.vue b/src/components/preview/PdfPreview.vue
index dac2b091..6e05bbd6 100644
--- a/src/components/preview/PdfPreview.vue
+++ b/src/components/preview/PdfPreview.vue
@@ -10,7 +10,10 @@ import Skeleton from '@/components/ui/Skeleton.vue'
 import { ExternalLink, FileText } from '@lucide/vue'
 
 const props = defineProps<{ url: string; name?: string }>()
-const emit = defineEmits<{ (e: 'locked'): void }>()
+/** `locked` names the URL whose read a locked bucket refused. */
+const emit = defineEmits<{ (e: 'locked', url: string): void }>()
+// A viewer that is gone neither reports nor keeps what its read returns.
+const reading = new AbortController()
 
 const blobUrl = ref<string | null>(null)
 const failed = ref(false)
@@ -21,23 +24,27 @@ function openTab() {
 }
 
 onMounted(async () => {
+  const url = props.url
   try {
-    const response = await fetch(props.url)
+    const response = await fetch(url, { signal: reading.signal })
+    if (reading.signal.aborted) return
     if (response.status === 403 && response.headers.get(BUCKET_LOCKED_HEADER) === 'true') {
-      emit('locked')
+      emit('locked', url)
       return
     }
     if (!response.ok) throw new Error(`HTTP ${response.status}`)
     const blob = await response.blob()
+    if (reading.signal.aborted) return
     blobUrl.value = URL.createObjectURL(new Blob([blob], { type: 'application/pdf' }))
   } catch {
-    failed.value = true
+    if (!reading.signal.aborted) failed.value = true
   } finally {
-    loading.value = false
+    if (!reading.signal.aborted) loading.value = false
   }
 })
 
 onBeforeUnmount(() => {
+  reading.abort()
   if (blobUrl.value) URL.revokeObjectURL(blobUrl.value)
 })
 </script>
diff --git a/src/components/preview/PreviewBody.test.ts b/src/components/preview/PreviewBody.test.ts
index fb421ba7..04a7b602 100644
--- a/src/components/preview/PreviewBody.test.ts
+++ b/src/components/preview/PreviewBody.test.ts
@@ -1,7 +1,7 @@
 import { defineComponent, h, reactive, ref } from 'vue'
 import * as VueRuntime from 'vue'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { button, click, compileClientComponent, flush, mountApp, moduleDefault } from '@/test/clientRender'
+import { button, click, compileClientComponent, element, flush, mountApp, moduleDefault } from '@/test/clientRender'
 
 const Slotted = (tag: string) =>
   defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
@@ -54,8 +54,8 @@ const body = compileClientComponent(new URL('./PreviewBody.vue', import.meta.url
   './MarkdownPreview.vue': moduleDefault(Slotted('div')),
   './CsvPreview.vue': moduleDefault(Slotted('div')),
   './ImagePreview.vue': moduleDefault(Slotted('div')),
-  './MediaPreview.vue': moduleDefault(Slotted('div')),
-  './PdfPreview.vue': moduleDefault(Slotted('div')),
+  './MediaPreview.vue': moduleDefault(Slotted('video')),
+  './PdfPreview.vue': moduleDefault(Slotted('object')),
   './DownloadCard.vue': moduleDefault(Slotted('div')),
 })
 
@@ -66,6 +66,10 @@ const anchor = { href: '', download: '', rel: '', click: vi.fn(), remove: vi.fn(
 beforeEach(() => {
   Object.assign(shown, { active: true, bucket: 'reef', objectKey: 'a.txt', name: 'a.txt', nodeId: null })
   preview.sessionKey.value = 'session-1'
+  preview.status.value = 'idle'
+  preview.kind.value = 'download'
+  preview.directUrl.value = null
+  preview.markLocked.mockReset()
   token = 1
   load.mockReset()
   urlFor.mockReset().mockReturnValue(null)
@@ -124,4 +128,26 @@ describe('preview body', () => {
     expect(checkAccess).not.toHaveBeenCalled()
     expect(anchor.click).not.toHaveBeenCalled()
   })
+
+  it('acts on viewer reports only for the file it still shows', async () => {
+    preview.status.value = 'ready'
+    preview.kind.value = 'media'
+    preview.directUrl.value = 'https://signed/current'
+    const { root } = await mountApp(Host)
+    await vi.waitFor(() => element(root, (node) => node.tag === 'video'))
+    const player = element(root, (node) => node.tag === 'video')
+
+    await (player.props.onFailed as (url: string) => Promise<void>)('https://signed/old')
+    expect(checkAccess).not.toHaveBeenCalled()
+    await (player.props.onFailed as (url: string) => Promise<void>)('https://signed/current')
+    expect(checkAccess).toHaveBeenCalledWith('https://signed/current', 1)
+
+    preview.kind.value = 'pdf'
+    await vi.waitFor(() => element(root, (node) => node.tag === 'object'))
+    const pdf = element(root, (node) => node.tag === 'object')
+    ;(pdf.props.onLocked as (url: string) => void)('https://signed/old')
+    expect(preview.markLocked).not.toHaveBeenCalled()
+    ;(pdf.props.onLocked as (url: string) => void)('https://signed/current')
+    expect(preview.markLocked).toHaveBeenCalledOnce()
+  })
 })
diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index 7bf6a57e..a95da5c4 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -132,9 +132,13 @@ async function download() {
 }
 
 // A player that cannot read its URL is waiting for a key only when a probe confirms the lock.
-async function mediaFailed() {
-  const url = preview.directUrl.value
-  if (url) await preview.checkAccess(url, preview.loadToken())
+// Reports about a URL the preview no longer shows are ignored.
+async function mediaFailed(url: string) {
+  if (url === preview.directUrl.value) await preview.checkAccess(url, preview.loadToken())
+}
+
+function pdfLocked(url: string) {
+  if (url === preview.directUrl.value) preview.markLocked()
 }
 </script>
 
@@ -261,7 +265,7 @@ async function mediaFailed() {
         v-else-if="preview.kind.value === 'pdf' && preview.directUrl.value"
         :url="preview.directUrl.value"
         :name="props.name"
-        @locked="preview.markLocked()"
+        @locked="pdfLocked"
       />
       <DownloadCard
         v-else

From 9bc7cc074946dd573632fdbeceb7e31a818b57e4 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:20:28 +0200
Subject: [PATCH 58/86] fix: drop the outcome of a holder change made under an
 older bucket key

---
 .../storage/BucketHoldersSection.vue          |  7 +++--
 src/composables/useBucketHolders.test.ts      | 19 ++++++++++++
 src/composables/useBucketHolders.ts           | 30 ++++++++++++++-----
 3 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/src/components/storage/BucketHoldersSection.vue b/src/components/storage/BucketHoldersSection.vue
index d036b4ed..0d4f35c9 100644
--- a/src/components/storage/BucketHoldersSection.vue
+++ b/src/components/storage/BucketHoldersSection.vue
@@ -85,9 +85,10 @@ async function addHolder() {
   busy.value = chosen.value.user_id
   failure.value = null
   try {
-    await grant(chosen.value.user_id)
-    query.value = ''
-    chosen.value = null
+    if (await grant(chosen.value.user_id)) {
+      query.value = ''
+      chosen.value = null
+    }
   } catch (cause) {
     failure.value = encryptionError(cause)
   } finally {
diff --git a/src/composables/useBucketHolders.test.ts b/src/composables/useBucketHolders.test.ts
index c86ecbe7..d1e04380 100644
--- a/src/composables/useBucketHolders.test.ts
+++ b/src/composables/useBucketHolders.test.ts
@@ -163,4 +163,23 @@ describe('bucket key holders', () => {
 
     expect(holders.holders.value?.holders.map((entry) => entry.user_id)).toEqual(['NEW'])
   })
+
+  it('drops the outcome of a grant or removal whose key generation changed meanwhile', async () => {
+    const holders = holdersOf()
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
+    let refuse!: (reason: unknown) => void
+    grantBucketHolder.mockReturnValueOnce(new Promise((_, reject) => (refuse = reject)))
+    let removed!: () => void
+    removeBucketHolder.mockReturnValueOnce(new Promise<void>((resolve) => (removed = resolve)))
+
+    const granting = holders.grant('C')
+    const removing = holders.remove('A', false, 'rev-1')
+    shown.value = { bucket_id: 'B1', key_generation: 3 } as BucketEncryptionResponse
+    refuse(refusal('stale_generation'))
+    removed()
+
+    expect(await granting).toBe(false)
+    expect(await removing).toBe('stale')
+    expect(source.load).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/composables/useBucketHolders.ts b/src/composables/useBucketHolders.ts
index b17478de..73ed8f89 100644
--- a/src/composables/useBucketHolders.ts
+++ b/src/composables/useBucketHolders.ts
@@ -27,7 +27,8 @@ export interface HolderSource {
 }
 
 export type HoldersState = 'loading' | 'ready' | 'refused' | 'failed'
-export type RemovalResult = 'removed' | 'confirm'
+/** `stale`: the bucket or its key changed while the removal ran; its outcome is not shown. */
+export type RemovalResult = 'removed' | 'confirm' | 'stale'
 /** `unknown`: a remaining recovery code is unknown, or the list is partial. */
 export type RecoveryAfter = 'kept' | 'unmet' | 'unknown'
 
@@ -92,30 +93,45 @@ export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
   )
   watch(source.revision, () => void load())
 
-  async function grant(userId: string): Promise<void> {
+  /** True while the bucket context and the key identity a request began with still hold. */
+  function holderBinder(): () => boolean {
     const bound = source.binder()
+    const seen = identity.value
+    return () => bound() && identity.value === seen
+  }
+
+  /** False when a newer bucket context owns the outcome; its success and failure are dropped. */
+  async function grant(userId: string): Promise<boolean> {
+    const current = holderBinder()
     try {
       await grantBucketHolder(bucket.value, userId, source.client())
-    } finally {
-      await refresh(bound)
+    } catch (cause) {
+      if (!current()) return false
+      await refresh(current)
+      throw cause
     }
+    if (!current()) return false
+    await refresh(current)
+    return true
   }
 
   // Without `confirmRecovery` a removal that breaks recovery comes back as `confirm`. `revision`
   // names the holder set the caller showed; the node refuses the removal once the set changed.
   async function remove(userId: string, confirmRecovery: boolean, revision: string): Promise<RemovalResult> {
-    const bound = source.binder()
+    const current = holderBinder()
     try {
       await removeBucketHolder(bucket.value, userId, revision, confirmRecovery, source.client())
     } catch (cause) {
+      if (!current()) return 'stale'
       if (encryptionRefusal(cause, 409, ENCRYPTION_CODES.confirmRecovery)) return 'confirm'
       if (encryptionRefusal(cause, 409, ENCRYPTION_CODES.staleHolders)) {
-        await refresh(bound)
+        await refresh(current)
         throw new Error('The key holders changed meanwhile. Check the list and try again.')
       }
       throw cause
     }
-    await refresh(bound)
+    if (!current()) return 'stale'
+    await refresh(current)
     return 'removed'
   }
 

From a58364f0a1ee199aed307232faf6b124e6430918 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:21:05 +0200
Subject: [PATCH 59/86] fix: report a dropped unlock result without claiming
 what was sent

---
 .../storage/BucketUnlockDialog.test.ts          | 10 ++++++++++
 src/components/storage/BucketUnlockDialog.vue   |  4 +++-
 src/lib/vault/bucketUnlock.test.ts              | 17 +++++++++++++++++
 src/lib/vault/bucketUnlock.ts                   |  2 ++
 4 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/components/storage/BucketUnlockDialog.test.ts b/src/components/storage/BucketUnlockDialog.test.ts
index d7937119..56bd8003 100644
--- a/src/components/storage/BucketUnlockDialog.test.ts
+++ b/src/components/storage/BucketUnlockDialog.test.ts
@@ -127,4 +127,14 @@ describe('bucket unlock dialog', () => {
 
     expect(content(root)).toContain('this key does not belong to the bucket')
   })
+
+  it('claims nothing about a result it does not show', async () => {
+    unlock.mockResolvedValueOnce(null)
+    const root = await render()
+
+    await click(button(root, 'Unlock'))
+
+    expect(content(root)).toContain('so the result is not shown')
+    expect(content(root)).not.toContain('Nothing was sent')
+  })
 })
diff --git a/src/components/storage/BucketUnlockDialog.vue b/src/components/storage/BucketUnlockDialog.vue
index a8f40d22..a4f300de 100644
--- a/src/components/storage/BucketUnlockDialog.vue
+++ b/src/components/storage/BucketUnlockDialog.vue
@@ -62,7 +62,9 @@ async function submit() {
   failure.value = null
   try {
     outcome.value = await props.unlock(props.generation, duration.value ? Number(duration.value) : undefined)
-    if (!outcome.value) failure.value = 'The bucket changed while it was being unlocked. Nothing was sent.'
+    if (!outcome.value) {
+      failure.value = 'The bucket or your session changed meanwhile, so the result is not shown. Check the bucket state.'
+    }
   } catch (cause) {
     failure.value = encryptionError(cause)
   } finally {
diff --git a/src/lib/vault/bucketUnlock.test.ts b/src/lib/vault/bucketUnlock.test.ts
index f540bc07..32df6259 100644
--- a/src/lib/vault/bucketUnlock.test.ts
+++ b/src/lib/vault/bucketUnlock.test.ts
@@ -155,6 +155,23 @@ describe('bucket unlock from the browser', () => {
     expect(sent).toHaveLength(0)
   })
 
+  it('names a vault locked while the copies were tried instead of a copy that did not open', async () => {
+    node([COPY], UNLOCKED)
+    const keys = vault()
+    const decrypt = crypto.subtle.decrypt.bind(crypto.subtle)
+    const opening = vi.spyOn(crypto.subtle, 'decrypt').mockImplementation(async (...args) => {
+      keys.lifetime.open = false
+      return decrypt(...args)
+    })
+    const otherBucket = { ...TARGET, publicKey: base64(hex(vector.recipient_public)) }
+
+    try {
+      await expect(unlockWithVault(otherBucket, keys, always)).rejects.toThrow(VaultClosedError)
+    } finally {
+      opening.mockRestore()
+    }
+  })
+
   it('reports an unknown outcome once and does not send the key again', async () => {
     const sent = node([COPY], () => Promise.reject(new TypeError('network down')))
 
diff --git a/src/lib/vault/bucketUnlock.ts b/src/lib/vault/bucketUnlock.ts
index 4122b5bc..98bb8a35 100644
--- a/src/lib/vault/bucketUnlock.ts
+++ b/src/lib/vault/bucketUnlock.ts
@@ -87,6 +87,8 @@ async function openFirst(
       if (!(cause instanceof SealOpenError || cause instanceof BucketKeyMismatchError)) throw cause
     }
   }
+  // A lock or a context change while the copies were tried outranks why none opened.
+  guard()
   if (!copies.length) {
     throw new NoUsableCopyError('You have no ready copy of this bucket key yet. Another key holder must unlock the bucket first.')
   }

From 29fb3119f2297b02e9dd661adcdca4666da9edcb Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:45:08 +0200
Subject: [PATCH 60/86] fix: bind preview reloads and signed URL reuse to the
 active S3 session

---
 src/components/preview/PreviewBody.test.ts | 11 ++++--
 src/composables/useObjectPreview.test.ts   | 42 ++++++++++++++++++++--
 src/composables/useObjectPreview.ts        | 36 ++++++++++++++-----
 3 files changed, 77 insertions(+), 12 deletions(-)

diff --git a/src/components/preview/PreviewBody.test.ts b/src/components/preview/PreviewBody.test.ts
index 04a7b602..db62b9f6 100644
--- a/src/components/preview/PreviewBody.test.ts
+++ b/src/components/preview/PreviewBody.test.ts
@@ -59,7 +59,7 @@ const body = compileClientComponent(new URL('./PreviewBody.vue', import.meta.url
   './DownloadCard.vue': moduleDefault(Slotted('div')),
 })
 
-const shown = reactive({ active: true, bucket: 'reef', objectKey: 'a.txt', name: 'a.txt', nodeId: null as string | null })
+const shown = reactive({ active: true, bucket: 'reef', objectKey: 'a.txt', name: 'a.txt', nodeId: null as string | null | undefined })
 const Host = defineComponent(() => () => h(body, { ...shown }))
 const anchor = { href: '', download: '', rel: '', click: vi.fn(), remove: vi.fn() }
 
@@ -93,12 +93,19 @@ describe('preview body', () => {
     await flush()
     preview.sessionKey.value = 'session-2'
     await flush()
+    // Null is the connected node, an omitted node the active S3 session's node.
+    shown.nodeId = null
+    await flush()
+    shown.nodeId = undefined
+    await flush()
 
-    expect(load.mock.calls.map(([target]) => [target.bucket, target.nodeId ?? null])).toEqual([
+    expect(load.mock.calls.map(([target]) => [target.bucket, target.nodeId])).toEqual([
       ['reef', null],
       ['other', null],
       ['other', 'node-b'],
       ['other', 'node-b'],
+      ['other', null],
+      ['other', undefined],
     ])
   })
 
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 5b9b1bcf..5be69468 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { effectScope } from 'vue'
+import { effectScope, shallowRef } from 'vue'
 import * as Api from '@/lib/api'
 import type { BucketEncryptionResponse, BucketUnlockStatus } from '@/lib/api'
 import { useObjectPreview } from './useObjectPreview'
@@ -7,9 +7,12 @@ import { useObjectPreview } from './useObjectPreview'
 const getObjectText = vi.fn()
 const probeAccess = vi.fn()
 const getBucketEncryption = vi.fn()
+const downloadUrl = vi.fn()
+const SESSION = { issuerNodeId: 'node-a', groupId: 'G1', accessKeyId: 'AK1', expiresAt: 1_000_000 }
+const activeSession = shallowRef(SESSION)
 
 vi.mock('./useS3', () => ({
-  useS3: () => ({ getObjectText, probeAccess, downloadUrl: async () => 'https://b.test/presigned' }),
+  useS3: () => ({ getObjectText, probeAccess, downloadUrl, activeSession }),
   s3ErrorMessage: (error: unknown) => (error instanceof Error ? error.message : String(error)),
 }))
 vi.mock('./s3/endpoints', () => ({
@@ -39,6 +42,8 @@ beforeEach(() => {
   getObjectText.mockReset()
   probeAccess.mockReset().mockResolvedValue('open')
   getBucketEncryption.mockReset()
+  downloadUrl.mockReset().mockResolvedValue('https://b.test/presigned')
+  activeSession.value = SESSION
 })
 
 describe('preview of a locked bucket', () => {
@@ -196,6 +201,39 @@ describe('preview of a locked bucket', () => {
     expect(preview.urlFor({ ...clip, versionId: 'v2' })).toBeNull()
   })
 
+  it('hands out its signed URL only under the S3 session that signed it', async () => {
+    const preview = useObjectPreview()
+    // No node: the URL is signed by the active S3 session's node, which null does not mean.
+    const clip = { bucket: 'reef', key: 'clip.mp4' }
+    await preview.load(clip)
+    const signed = preview.sessionKey.value
+    expect(preview.urlFor(clip)).toBe('https://b.test/presigned')
+    expect(preview.urlFor({ ...clip, nodeId: null })).toBeNull()
+
+    activeSession.value = { ...SESSION, issuerNodeId: 'node-b' }
+    expect(preview.sessionKey.value).not.toBe(signed)
+    expect(preview.urlFor(clip)).toBeNull()
+
+    // A credential refresh keeps the access key and moves the expiry.
+    activeSession.value = { ...SESSION, expiresAt: SESSION.expiresAt + 60_000 }
+    expect(preview.sessionKey.value).not.toBe(signed)
+    expect(preview.urlFor(clip)).toBeNull()
+  })
+
+  it('binds a signed URL to the S3 session it was signed under, not the one it arrived in', async () => {
+    let sign!: (url: string) => void
+    downloadUrl.mockReturnValueOnce(new Promise((resolve) => (sign = resolve)))
+    const preview = useObjectPreview()
+    const clip = { bucket: 'reef', key: 'clip.mp4' }
+
+    const loading = preview.load(clip)
+    activeSession.value = { ...SESSION, issuerNodeId: 'node-b' }
+    sign('https://a.test/presigned')
+    await loading
+
+    expect(preview.urlFor(clip)).toBeNull()
+  })
+
   it('ends every pending request when the preview is disposed', async () => {
     const scope = effectScope()
     const preview = scope.run(() => useObjectPreview())!
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 57bf625b..50efc60a 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -132,10 +132,21 @@ export function useObjectPreview() {
   const sizeNote = ref<string | null>(null)
   const referenced = ref(false)
   let referenceProbeId = 0
-  /** Account, session and S3 group a preview is read under; a change means reading again. */
-  const sessionKey = computed(() =>
-    [sessionEpoch.value, userInfo.value?.user.user_id ?? '', s3.activeContext?.value?.groupId ?? ''].join('\u0000'),
-  )
+  // Account, session and the S3 session a URL is signed under: issuer node, group, access key
+  // and expiry, which a credential refresh moves. A change means reading again.
+  const sessionKey = computed(() => {
+    const session = s3.activeSession?.value
+    return [
+      sessionEpoch.value,
+      userInfo.value?.user.user_id ?? '',
+      session?.issuerNodeId ?? '',
+      session?.groupId ?? '',
+      session?.accessKeyId ?? '',
+      session?.expiresAt ?? '',
+    ].join('\u0000')
+  })
+  /** The session key the current signed URL was made under. */
+  let signedUnder = ''
 
   function reset() {
     probes.abort()
@@ -182,14 +193,15 @@ export function useObjectPreview() {
     status.value = 'locked'
   }
 
-  /** The signed URL of the current load, only when it was signed for `target`. */
+  // The signed URL of the current load, only for the same object under the same S3 session. An
+  // omitted node (the active session's node) and null (the connected node) stay different.
   function urlFor(target: PreviewTarget): string | null {
     const shown = currentTarget
-    if (!shown || !directUrl.value) return null
+    if (!shown || !directUrl.value || signedUnder !== sessionKey.value) return null
     const same =
       shown.bucket === target.bucket &&
       shown.key === target.key &&
-      (shown.nodeId ?? null) === (target.nodeId ?? null) &&
+      shown.nodeId === target.nodeId &&
       (shown.versionId ?? null) === (target.versionId ?? null)
     return same ? directUrl.value : null
   }
@@ -216,11 +228,13 @@ export function useObjectPreview() {
     kind.value = 'download'
     sizeNote.value = `This file is ${formatBytes(actual)}, above the ${formatBytes(cap)} preview limit.`
     try {
+      const signingKey = sessionKey.value
       const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
       if (id !== loadId) return
       const open = await checkAccess(url, id, target)
       if (id !== loadId || !open) return
       directUrl.value = url
+      signedUnder = signingKey
       status.value = 'ready'
     } catch (err) {
       if (id !== loadId) return
@@ -241,11 +255,13 @@ export function useObjectPreview() {
     try {
       if (classified.kind === 'media' || classified.kind === 'pdf' || classified.kind === 'download') {
         if (classified.kind === 'media') mediaKind.value = mediaSubtype(target)
+        const signingKey = sessionKey.value
         const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
         if (id !== loadId) return
         const open = await checkAccess(url, id, target)
         if (id !== loadId || !open) return
         directUrl.value = url
+        signedUnder = signingKey
         status.value = 'ready'
         return
       }
@@ -288,8 +304,12 @@ export function useObjectPreview() {
       if (err instanceof TypeError) corsBlocked.value = true
       else errorMessage.value = s3ErrorMessage(err)
       try {
+        const signingKey = sessionKey.value
         const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
-        if (id === loadId) directUrl.value = url
+        if (id === loadId) {
+          directUrl.value = url
+          signedUnder = signingKey
+        }
       } catch {
         // Leave directUrl null; the pane still offers its own download button.
       }

From 3b3e7e842543cb79591d63b839b7ab2cb16af193 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:47:54 +0200
Subject: [PATCH 61/86] fix: keep a confirmed preview lock through later read
 and download failures

---
 src/components/preview/PreviewBody.test.ts | 20 +++++++++++++++-
 src/components/preview/PreviewBody.vue     |  7 +++---
 src/composables/useObjectPreview.test.ts   | 28 ++++++++++++++++++++++
 src/composables/useObjectPreview.ts        | 19 +++++++++++----
 4 files changed, 65 insertions(+), 9 deletions(-)

diff --git a/src/components/preview/PreviewBody.test.ts b/src/components/preview/PreviewBody.test.ts
index db62b9f6..eb977a0e 100644
--- a/src/components/preview/PreviewBody.test.ts
+++ b/src/components/preview/PreviewBody.test.ts
@@ -1,7 +1,7 @@
 import { defineComponent, h, reactive, ref } from 'vue'
 import * as VueRuntime from 'vue'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { button, click, compileClientComponent, element, flush, mountApp, moduleDefault } from '@/test/clientRender'
+import { button, click, compileClientComponent, content, element, flush, mountApp, moduleDefault } from '@/test/clientRender'
 
 const Slotted = (tag: string) =>
   defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
@@ -21,6 +21,7 @@ const preview = {
   objectUrl: ref(null),
   directUrl: ref<string | null>(null),
   errorMessage: ref(null),
+  downloadError: ref<string | null>(null),
   corsBlocked: ref(false),
   sizeNote: ref(null),
   referenced: ref(false),
@@ -69,6 +70,7 @@ beforeEach(() => {
   preview.status.value = 'idle'
   preview.kind.value = 'download'
   preview.directUrl.value = null
+  preview.downloadError.value = null
   preview.markLocked.mockReset()
   token = 1
   load.mockReset()
@@ -136,6 +138,22 @@ describe('preview body', () => {
     expect(anchor.click).not.toHaveBeenCalled()
   })
 
+  it('reports a failed download beside a locked or ready preview instead of replacing it', async () => {
+    downloadUrl.mockRejectedValue(new Error('signing failed'))
+    preview.status.value = 'locked'
+    const { root } = await mountApp(Host)
+
+    await click(button(root, 'Download'))
+    expect(preview.status.value).toBe('locked')
+    expect(preview.downloadError.value).toBe('Error: signing failed')
+
+    preview.status.value = 'ready'
+    await click(button(root, 'Download'))
+    await flush()
+    expect(preview.status.value).toBe('ready')
+    expect(content(element(root, (node) => node.tag === 'aside'))).toContain('signing failed')
+  })
+
   it('acts on viewer reports only for the file it still shows', async () => {
     preview.status.value = 'ready'
     preview.kind.value = 'media'
diff --git a/src/components/preview/PreviewBody.vue b/src/components/preview/PreviewBody.vue
index a95da5c4..b9de633b 100644
--- a/src/components/preview/PreviewBody.vue
+++ b/src/components/preview/PreviewBody.vue
@@ -100,6 +100,7 @@ watch(
 // A download belongs to the preview it was started from; a newer one drops its result.
 async function download() {
   if (!props.objectKey) return
+  preview.downloadError.value = null
   const id = preview.loadToken()
   const target = shownTarget()
   try {
@@ -125,9 +126,7 @@ async function download() {
     anchor.click()
     anchor.remove()
   } catch (err) {
-    if (!preview.isCurrent(id)) return
-    preview.errorMessage.value = s3ErrorMessage(err)
-    preview.status.value = 'error'
+    if (preview.isCurrent(id)) preview.downloadError.value = s3ErrorMessage(err)
   }
 }
 
@@ -181,6 +180,8 @@ function pdfLocked(url: string) {
       </div>
     </div>
 
+    <Notice v-if="preview.downloadError.value" tone="error">{{ preview.downloadError.value }}</Notice>
+
     <Spinner
       v-if="preview.status.value === 'loading'"
       show-label
diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index 5be69468..e1810f96 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -263,6 +263,34 @@ describe('preview of a locked bucket', () => {
     expect(preview.directUrl.value).toBeNull()
   })
 
+  it('keeps a lock a download probe confirmed when the earlier read ends later', async () => {
+    let fail!: (reason: unknown) => void
+    getObjectText.mockReturnValueOnce(new Promise((_, reject) => (fail = reject)))
+    const preview = useObjectPreview()
+
+    const failing = preview.load(TARGET)
+    probeAccess.mockResolvedValueOnce('locked')
+    expect(await preview.checkAccess('https://b.test/presigned', preview.loadToken(), TARGET)).toBe(false)
+    fail(new Error('connection reset'))
+    await failing
+
+    expect(preview.status.value).toBe('locked')
+    expect(preview.errorMessage.value).toBeNull()
+    probeAccess.mockResolvedValueOnce('unknown')
+    expect(await preview.checkAccess('https://b.test/presigned', preview.loadToken(), TARGET)).toBe(false)
+
+    let answer!: (value: string) => void
+    getObjectText.mockReturnValueOnce(new Promise((resolve) => (answer = resolve)))
+    const reading = preview.load(TARGET)
+    probeAccess.mockResolvedValueOnce('locked')
+    await preview.checkAccess('https://b.test/presigned', preview.loadToken(), TARGET)
+    answer('plain text')
+    await reading
+
+    expect(preview.status.value).toBe('locked')
+    expect(preview.text.value).toBeNull()
+  })
+
   it('never reads a cancelled probe as permission', async () => {
     probeAccess.mockImplementationOnce(
       (_url: string, signal: AbortSignal) =>
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 50efc60a..16a554fe 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -128,6 +128,8 @@ export function useObjectPreview() {
   const objectUrl = ref<string | null>(null)
   const directUrl = ref<string | null>(null)
   const errorMessage = ref<string | null>(null)
+  /** A failed download of the current load; it never replaces what the preview shows. */
+  const downloadError = ref<string | null>(null)
   const corsBlocked = ref(false)
   const sizeNote = ref<string | null>(null)
   const referenced = ref(false)
@@ -161,6 +163,7 @@ export function useObjectPreview() {
     objectUrl.value = null
     directUrl.value = null
     errorMessage.value = null
+    downloadError.value = null
     corsBlocked.value = false
     sizeNote.value = null
     referenced.value = false
@@ -224,6 +227,10 @@ export function useObjectPreview() {
     return status.value !== 'locked'
   }
 
+  // A result may settle load `id` only while it is current and no probe of it confirmed a lock.
+  // Only a reset, and so a recheck or reload, ends a confirmed lock.
+  const settles = (id: number) => id === loadId && status.value !== 'locked'
+
   async function fallbackDownload(target: PreviewTarget, cap: number, actual: number, id: number) {
     kind.value = 'download'
     sizeNote.value = `This file is ${formatBytes(actual)}, above the ${formatBytes(cap)} preview limit.`
@@ -237,7 +244,7 @@ export function useObjectPreview() {
       signedUnder = signingKey
       status.value = 'ready'
     } catch (err) {
-      if (id !== loadId) return
+      if (!settles(id)) return
       errorMessage.value = s3ErrorMessage(err)
       status.value = 'error'
     }
@@ -274,7 +281,7 @@ export function useObjectPreview() {
 
       if (classified.kind === 'image') {
         const blob = await s3.getObjectBlob(target.bucket, target.key, target.nodeId, target.versionId)
-        if (id !== loadId) return
+        if (!settles(id)) return
         if (blob.size > cap) {
           await fallbackDownload(target, cap, blob.size, id)
           return
@@ -282,7 +289,7 @@ export function useObjectPreview() {
         objectUrl.value = URL.createObjectURL(blob)
       } else {
         const content = await s3.getObjectText(target.bucket, target.key, target.nodeId, target.versionId)
-        if (id !== loadId) return
+        if (!settles(id)) return
         // Coarse guard for objects whose size was not listed up front.
         if (content.length > cap) {
           await fallbackDownload(target, cap, content.length, id)
@@ -299,6 +306,7 @@ export function useObjectPreview() {
         status.value = 'locked'
         return
       }
+      if (!settles(id)) return
       // A cross-origin fetch blocked by bucket CORS (or an offline node) rejects
       // with a TypeError and no response; anything else is a real read error.
       if (err instanceof TypeError) corsBlocked.value = true
@@ -306,14 +314,14 @@ export function useObjectPreview() {
       try {
         const signingKey = sessionKey.value
         const url = await s3.downloadUrl(target.bucket, target.key, target.nodeId, target.versionId)
-        if (id === loadId) {
+        if (settles(id)) {
           directUrl.value = url
           signedUnder = signingKey
         }
       } catch {
         // Leave directUrl null; the pane still offers its own download button.
       }
-      if (id === loadId) status.value = 'error'
+      if (settles(id)) status.value = 'error'
     }
   }
 
@@ -367,6 +375,7 @@ export function useObjectPreview() {
     objectUrl,
     directUrl,
     errorMessage,
+    downloadError,
     corsBlocked,
     sizeNote,
     referenced,

From 5b32b350f6d73a9b03db83f0138492a80e7fb8da Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:49:20 +0200
Subject: [PATCH 62/86] fix: drop a holder change outcome when the key changes
 during its refresh

---
 src/composables/useBucketHolders.test.ts | 21 +++++++++++++++++++++
 src/composables/useBucketHolders.ts      |  6 ++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/src/composables/useBucketHolders.test.ts b/src/composables/useBucketHolders.test.ts
index d1e04380..920899c7 100644
--- a/src/composables/useBucketHolders.test.ts
+++ b/src/composables/useBucketHolders.test.ts
@@ -182,4 +182,25 @@ describe('bucket key holders', () => {
     expect(await removing).toBe('stale')
     expect(source.load).not.toHaveBeenCalled()
   })
+
+  it('drops the outcome of a grant or removal whose key generation changed during the final refresh', async () => {
+    const holders = holdersOf()
+    await vi.waitFor(() => expect(holders.state.value).toBe('ready'))
+    const rotate = async () => {
+      shown.value = { bucket_id: 'B1', key_generation: (shown.value?.key_generation ?? 0) + 1 } as BucketEncryptionResponse
+    }
+
+    source.load.mockImplementationOnce(rotate)
+    expect(await holders.grant('C')).toBe(false)
+    source.load.mockImplementationOnce(rotate)
+    expect(await holders.remove('A', true, 'rev-1')).toBe('stale')
+
+    grantBucketHolder.mockRejectedValueOnce(new Api.ApiError(500, 'grant failed'))
+    source.load.mockImplementationOnce(rotate)
+    expect(await holders.grant('C')).toBe(false)
+    removeBucketHolder.mockRejectedValueOnce(refusal('stale_holders'))
+    source.load.mockImplementationOnce(rotate)
+    expect(await holders.remove('A', false, 'rev-1')).toBe('stale')
+    expect(source.load).toHaveBeenCalledTimes(4)
+  })
 })
diff --git a/src/composables/useBucketHolders.ts b/src/composables/useBucketHolders.ts
index 73ed8f89..324dde63 100644
--- a/src/composables/useBucketHolders.ts
+++ b/src/composables/useBucketHolders.ts
@@ -108,11 +108,12 @@ export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
     } catch (cause) {
       if (!current()) return false
       await refresh(current)
+      if (!current()) return false
       throw cause
     }
     if (!current()) return false
     await refresh(current)
-    return true
+    return current()
   }
 
   // Without `confirmRecovery` a removal that breaks recovery comes back as `confirm`. `revision`
@@ -126,13 +127,14 @@ export function useBucketHolders(source: HolderSource, bucket: Ref<string>) {
       if (encryptionRefusal(cause, 409, ENCRYPTION_CODES.confirmRecovery)) return 'confirm'
       if (encryptionRefusal(cause, 409, ENCRYPTION_CODES.staleHolders)) {
         await refresh(current)
+        if (!current()) return 'stale'
         throw new Error('The key holders changed meanwhile. Check the list and try again.')
       }
       throw cause
     }
     if (!current()) return 'stale'
     await refresh(current)
-    return 'removed'
+    return current() ? 'removed' : 'stale'
   }
 
   return { holders, state, error, load, grant, remove }

From ebc5959381fb54b1792b700ab53d778e2f1179a6 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:59:09 +0200
Subject: [PATCH 63/86] fix: let a failed vault save lock only the session that
 started it

---
 src/composables/useUserVault.test.ts | 23 +++++++++++++++++++++++
 src/composables/useUserVault.ts      |  4 +++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 231e1eec..1b812788 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -663,6 +663,29 @@ describe('useUserVault', () => {
     expect(saveVault).not.toHaveBeenCalled()
   })
 
+  it('locks no newer session when an older save finds its key no longer opens the vault', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', false)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const held = vi.spyOn(crypto.subtle, 'decrypt').mockImplementationOnce(async () => {
+      await gate
+      throw new DOMException('The key does not fit.', 'OperationError')
+    })
+
+    const saving = vault.saveProviders([work])
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    state.sessionEpoch.value += 1
+    await vault.load()
+    await vault.unlock('correct horse')
+    release()
+    await expect(saving).rejects.toThrow('changed in another browser')
+
+    expect(vault.state.value).toBe('unlocked')
+    expect(remembered.size).toBe(1)
+  })
+
   it('refuses to save while locked', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 3a6eef10..c2402175 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -592,6 +592,7 @@ async function reset(): Promise<void> {
 async function saveProviders(next: BrowserProvider[]): Promise<void> {
   const { key } = requireUnlocked()
   const base = providers.value
+  const run = generation
   try {
     await saveWithRetry(async (current) => {
       const merged = reapplyChange(await openProviders(current, key), base, next)
@@ -599,7 +600,8 @@ async function saveProviders(next: BrowserProvider[]): Promise<void> {
     })
   } catch (cause) {
     if (cause instanceof VaultUnlockError) {
-      lock()
+      // A lock or session change since the save began owns the vault; it stays as it is.
+      if (run === generation) lock()
       throw new Error(REPLACED)
     }
     throw cause

From b899f92942defebbe28601553b6f509c0362edcc Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 14:59:50 +0200
Subject: [PATCH 64/86] fix: let a vault read that a lock or session change
 ended leave the vault alone

---
 src/composables/useUserVault.test.ts | 38 ++++++++++++++++++++++++++++
 src/composables/useUserVault.ts      |  3 +++
 2 files changed, 41 insertions(+)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 1b812788..5792735d 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -53,6 +53,8 @@ const publishUserKey = vi.fn(async (request: { key_id: string; public_key: strin
 const cachedLoads = vi.fn(async (scope: string): Promise<FakeHead[] | null> => cached.get(scope) ?? null)
 const remembered = new Map<string, CryptoKey>()
 const cached = new Map<string, FakeHead[]>()
+/** Runs inside the vault's heads cache write, so a test can act right after the heads are taken. */
+let onSaveHeads: (() => void) | null = null
 const SCOPE = assistantChatScopeKey({ apiBaseUrl: 'https://node.test/api/v1', realmId: 'r-1', userId: 'u-1' })
 const stored = new Map<string, string>()
 vi.stubGlobal('localStorage', {
@@ -87,6 +89,7 @@ vi.mock('@/lib/vault/keyStore', () => ({
     },
     loadHeads: (scope: string) => cachedLoads(scope),
     saveHeads: async (scope: string, heads: FakeHead[]) => {
+      onSaveHeads?.()
       if (heads.length) cached.set(scope, heads)
       else cached.delete(scope)
     },
@@ -143,6 +146,7 @@ beforeEach(() => {
   remembered.clear()
   cached.clear()
   stored.clear()
+  onSaveHeads = null
   directory.length = 0
   listUserKeys.mockClear()
   publishUserKey.mockClear()
@@ -686,6 +690,40 @@ describe('useUserVault', () => {
     expect(remembered.size).toBe(1)
   })
 
+  it('keeps the key of a newer session when an older read finds its remembered key no longer fits', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', false)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const held = vi.spyOn(crypto.subtle, 'decrypt').mockImplementationOnce(async () => {
+      await gate
+      throw new DOMException('The key does not fit.', 'OperationError')
+    })
+
+    const reading = vault.load()
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    state.sessionEpoch.value += 1
+    await vault.load()
+    await vault.unlock('correct horse')
+    release()
+    await reading
+
+    expect(vault.state.value).toBe('unlocked')
+    expect(remembered.size).toBe(1)
+  })
+
+  it('stays cleared when a session change lands right after a read took the heads', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', false)
+    vault.lock()
+    onSaveHeads = () => queueMicrotask(() => (state.sessionEpoch.value += 1))
+
+    await vault.load()
+
+    expect(vault.state.value).toBe('absent')
+  })
+
   it('refuses to save while locked', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index c2402175..fa96e29e 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -274,10 +274,13 @@ async function settle(scope: string, list: UserVaultHead[]): Promise<boolean> {
       return await adoptHeads(list, run, key)
     } catch (cause) {
       if (!(cause instanceof VaultUnlockError)) throw cause
+      // A lock or session change during the merge owns the remembered key now.
+      if (run !== generation) throw new Error(REPLACED)
       forgetKey(scope)
     }
   }
   await adoptHeads(list, run, null)
+  if (run !== generation) throw new Error(REPLACED)
   masterKey = null
   providers.value = []
   state.value = 'locked'

From 8532cf3ce51bdd86194926a09fe01e34f0d3dad6 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:00:17 +0200
Subject: [PATCH 65/86] fix: remember no key of a new vault once a lock or
 session change ends its creation

---
 src/composables/useUserVault.test.ts | 10 ++++++++++
 src/composables/useUserVault.ts      |  1 +
 2 files changed, 11 insertions(+)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 5792735d..fc6d6190 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -724,6 +724,16 @@ describe('useUserVault', () => {
     expect(vault.state.value).toBe('absent')
   })
 
+  it('remembers no key of a vault it made when a lock lands right after the save', async () => {
+    const { vault } = await boot()
+    onSaveHeads = () => queueMicrotask(() => vault.lock())
+
+    await expect(vault.create('correct horse', false)).rejects.toThrow('changed in another browser')
+
+    expect(vault.state.value).toBe('locked')
+    expect(remembered.size).toBe(0)
+  })
+
   it('refuses to save while locked', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index fa96e29e..00d34bec 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -503,6 +503,7 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, client())
   if (run !== generation) throw new Error(REPLACED)
   await adoptHeads(response.heads, run, created.masterKey)
+  if (run !== generation) throw new Error(REPLACED)
   if (noticeState(scope) === 'pending') dismissRecreateNotice()
   await rememberKey(scope, created.masterKey)
   await finishUnlock(run, false)

From 354bdd5f02920341b38ee607f085882c43d0c599 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:08:36 +0200
Subject: [PATCH 66/86] fix: send a vault save only to the account and session
 it began in

---
 src/composables/useUserVault.test.ts | 57 +++++++++++++++++++++++++++-
 src/composables/useUserVault.ts      | 34 +++++++++++++----
 2 files changed, 83 insertions(+), 8 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index fc6d6190..b3eb25d4 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -24,7 +24,7 @@ const readVault = vi.fn(async () => {
   if (node.unsupported) throw refused(404, 'no such route')
   return { heads: [...node.heads] }
 })
-const saveVault = vi.fn(async (request: { payload: string; predecessors: string[] }) => {
+const saveVault = vi.fn(async (request: { payload: string; predecessors: string[] }, _client?: object) => {
   node.count += 1
   const head = {
     revision: `R${String(node.count).padStart(4, '0')}`,
@@ -734,6 +734,61 @@ describe('useUserVault', () => {
     expect(remembered.size).toBe(0)
   })
 
+  it('sends no new vault once the account changed while its keys were made', async () => {
+    const { vault, state } = await boot()
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const derive = crypto.subtle.deriveKey.bind(crypto.subtle)
+    const held = vi.spyOn(crypto.subtle, 'deriveKey').mockImplementationOnce(async (...args) => {
+      await gate
+      return derive(...args)
+    })
+
+    const creating = vault.create('correct horse', true)
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    state.userInfo.value = { user: { user_id: 'u-2' }, realm: { realm_id: 'r-1' } } as never
+    release()
+
+    await expect(creating).rejects.toThrow('changed in another browser')
+    expect(saveVault).not.toHaveBeenCalled()
+  })
+
+  it('sends a vault save only in the session it began in, with the token it began with', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', false)
+    const seal = crypto.subtle.encrypt.bind(crypto.subtle)
+    function holdSeal() {
+      let release!: () => void
+      const gate = new Promise<void>((resolve) => (release = resolve))
+      const held = vi.spyOn(crypto.subtle, 'encrypt').mockImplementationOnce(async (...args) => {
+        await gate
+        return seal(...args)
+      })
+      return { held, release }
+    }
+
+    const first = holdSeal()
+    const saving = vault.saveProviders([work])
+    await vi.waitFor(() => expect(first.held).toHaveBeenCalled())
+    first.held.mockRestore()
+    state.authToken.value = 'token-2'
+    first.release()
+    await saving
+    expect(saveVault.mock.calls.at(-1)?.[1]).toEqual({ baseUrl: 'https://node.test/api/v1', token: 'token' })
+
+    const sent = saveVault.mock.calls.length
+    const second = holdSeal()
+    const ended = vault.saveProviders([work, local])
+    await vi.waitFor(() => expect(second.held).toHaveBeenCalled())
+    second.held.mockRestore()
+    state.sessionEpoch.value += 1
+    second.release()
+
+    await expect(ended).rejects.toThrow('changed in another browser')
+    expect(saveVault).toHaveBeenCalledTimes(sent)
+  })
+
   it('refuses to save while locked', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 00d34bec..fcf71d70 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -14,6 +14,7 @@ import {
   vaultConflicted,
   vaultUnavailable,
   vaultUnsupported,
+  type ApiClientOptions,
   type UserVaultHead,
 } from '@/lib/api'
 import { validateBrowserProvider, type BrowserProvider } from '@/lib/assistant/browserProviders'
@@ -101,6 +102,21 @@ function currentScope(): string {
   return assistantChatScopeKey({ apiBaseUrl: apiBaseUrl.value, realmId, userId })
 }
 
+/** The API base and token a vault write began with, and the account scope they belong to. */
+interface WriteTarget {
+  scope: string
+  client: ApiClientOptions
+}
+
+function writeTarget(): WriteTarget {
+  return { scope: currentScope(), client: client() }
+}
+
+/** True once a lock, or an account, session or API base change, ended the write. */
+function writeEnded(run: number, target: WriteTarget): boolean {
+  return run !== generation || target.scope !== currentScope()
+}
+
 async function rememberKey(scope: string, key: CryptoKey) {
   try {
     await keyStore?.save(scope, key)
@@ -288,8 +304,9 @@ async function settle(scope: string, list: UserVaultHead[]): Promise<boolean> {
 }
 
 /** Saves `next` over every held head and takes the heads the holder answers with. */
-async function putPayload(next: VaultPayload, run: number): Promise<boolean> {
-  const response = await saveVault({ payload: JSON.stringify(next), predecessors }, client())
+async function putPayload(next: VaultPayload, run: number, target = writeTarget()): Promise<boolean> {
+  if (writeEnded(run, target)) throw new Error(REPLACED)
+  const response = await saveVault({ payload: JSON.stringify(next), predecessors }, target.client)
   if (run !== generation) throw new Error(REPLACED)
   return adoptHeads(response.heads, run)
 }
@@ -352,10 +369,10 @@ async function finishUnlock(run: number, saveDue: boolean) {
 }
 
 /** Saves a merge once; when that fails the next save carries the merge. */
-async function saveMerge(run: number) {
+async function saveMerge(run: number, target?: WriteTarget) {
   if (!payload) return
   try {
-    await putPayload(payload, run)
+    await putPayload(payload, run, target)
   } catch {
     // The merged payload and its predecessors stay in place for the next save.
   }
@@ -435,15 +452,16 @@ function requireUnlocked(): { current: VaultPayload; key: CryptoKey } {
 /** Saves over the held heads; when a holder lost a concurrent write, rebuilds on a fresh read once. */
 async function saveWithRetry(build: (current: VaultPayload) => Promise<VaultPayload>): Promise<void> {
   const run = generation
+  const target = writeTarget()
   requirePayload()
   for (let attempt = 0; ; attempt += 1) {
     const next = await build(requirePayload())
     try {
-      if (await putPayload(next, run)) await saveMerge(run)
+      if (await putPayload(next, run, target)) await saveMerge(run, target)
       return
     } catch (cause) {
       if (!vaultConflicted(cause) || attempt > 0 || run !== generation) throw cause
-      const response = await readVault(client())
+      const response = await readVault(target.client)
       if (run !== generation || !response.heads.length) throw new Error(REPLACED)
       await adoptHeads(response.heads, run)
     }
@@ -498,9 +516,11 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   if (payload) throw new Error('Your provider keys are already set up.')
   requireHolderLength(passphrase)
   const run = generation
+  const target = writeTarget()
   const created = await createVault(passphrase, withRecovery)
   created.payload.keys = await rotateKeypair(created.masterKey, [])
-  const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, client())
+  if (writeEnded(run, target)) throw new Error(REPLACED)
+  const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, target.client)
   if (run !== generation) throw new Error(REPLACED)
   await adoptHeads(response.heads, run, created.masterKey)
   if (run !== generation) throw new Error(REPLACED)

From ec358607b6a8c4c01e2d576a6cf84085ce83e03a Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:09:32 +0200
Subject: [PATCH 67/86] fix: end every running vault read and unlock when a
 reset deletes the vault

---
 src/composables/useUserVault.test.ts | 73 ++++++++++++++++++++++++++++
 src/composables/useUserVault.ts      | 11 +++++
 2 files changed, 84 insertions(+)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index b3eb25d4..a93df140 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -521,6 +521,79 @@ describe('useUserVault', () => {
     expect(readVault).toHaveBeenCalledTimes(2)
   })
 
+  it('drops a read that was running when a reset deleted the vault', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    const decrypt = crypto.subtle.decrypt.bind(crypto.subtle)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const held = vi.spyOn(crypto.subtle, 'decrypt').mockImplementationOnce(async (...args) => {
+      await gate
+      return decrypt(...args)
+    })
+
+    const reading = vault.load()
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    await vault.reset()
+    release()
+    await reading
+
+    expect(vault.state.value).toBe('absent')
+    expect(vault.loading.value).toBe(false)
+  })
+
+  it('drops a read that began while a reset deleted the vault', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    let deleted!: () => void
+    deleteVault.mockImplementationOnce(() => new Promise<void>((resolve) => (deleted = () => {
+      node.heads = []
+      resolve()
+    })))
+    const decrypt = crypto.subtle.decrypt.bind(crypto.subtle)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const held = vi.spyOn(crypto.subtle, 'decrypt').mockImplementationOnce(async (...args) => {
+      await gate
+      return decrypt(...args)
+    })
+
+    const resetting = vault.reset()
+    const reading = vault.load()
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    deleted()
+    await resetting
+    release()
+    await reading
+
+    expect(vault.state.value).toBe('absent')
+  })
+
+  it('drops an unlock that was running when a reset deleted the vault', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    vault.lock()
+    const decrypt = crypto.subtle.decrypt.bind(crypto.subtle)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const held = vi.spyOn(crypto.subtle, 'decrypt').mockImplementationOnce(async (...args) => {
+      await gate
+      return decrypt(...args)
+    })
+
+    const unlocking = vault.unlock('correct horse')
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    await vault.reset()
+    release()
+
+    await expect(unlocking).rejects.toThrow('changed in another browser')
+    expect(vault.state.value).toBe('absent')
+    expect(remembered.size).toBe(0)
+  })
+
   it('refuses a holder passphrase shorter than twelve characters', async () => {
     const { vault } = await boot()
     await expect(vault.create('eleven char', false)).rejects.toThrow('at least 12 characters')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index fcf71d70..c4c6ce76 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -597,12 +597,23 @@ async function openUserKey(keyId: string): Promise<X25519Pair | null> {
   return entry ? openKeypair(key, entry) : null
 }
 
+/** Ends every read, unlock and key check already running, for good. */
+function endRunningWork() {
+  generation += 1
+  inFlight = null
+  loading.value = false
+  keyCheck = null
+}
+
 async function reset(): Promise<void> {
   const scope = scopeKey
   const session = sessionGeneration
+  // Work running before or during the deletion read the old vault; none of it may restore it.
+  endRunningWork()
   await deleteVault(client())
   // The deletion belongs to this account and session; another one keeps its own state.
   if (session !== sessionGeneration) return
+  endRunningWork()
   payload = null
   masterKey = null
   providers.value = []

From 430bb40b1f203ae86aa9fbf3ce7ed50c202bd9a3 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:15:01 +0200
Subject: [PATCH 68/86] fix: hold the recovery code of a new vault for its
 session until dismissed

---
 src/composables/useUserVault.test.ts | 63 ++++++++++++++++++++++++++++
 src/composables/useUserVault.ts      | 18 +++++++-
 2 files changed, 80 insertions(+), 1 deletion(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index a93df140..34a0030d 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -862,6 +862,69 @@ describe('useUserVault', () => {
     expect(saveVault).toHaveBeenCalledTimes(sent)
   })
 
+  it('holds the recovery code of a new vault until it is dismissed, hidden while locked', async () => {
+    const { vault } = await boot()
+    const code = await vault.create('correct horse', true)
+
+    expect(vault.recoveryCode.value).toBe(code)
+    vault.lock()
+    expect(vault.recoveryCode.value).toBeNull()
+    await vault.unlock('correct horse')
+    expect(vault.recoveryCode.value).toBe(code)
+
+    vault.dismissRecovery()
+    expect(vault.recoveryCode.value).toBeNull()
+    vault.lock()
+    await vault.unlock('correct horse')
+    expect(vault.recoveryCode.value).toBeNull()
+  })
+
+  it('shows the code of a vault whose creation a lock ended once the same session unlocks', async () => {
+    const { vault } = await boot()
+    onSaveHeads = () => queueMicrotask(() => vault.lock())
+
+    await expect(vault.create('correct horse', true)).rejects.toThrow('changed in another browser')
+    onSaveHeads = null
+    expect(vault.recoveryCode.value).toBeNull()
+    await vault.unlock('correct horse')
+
+    expect(vault.recoveryCode.value).toMatch(/^([0-9A-HJKMNP-TV-Z]{4}-){12}[0-9A-HJKMNP-TV-Z]{4}$/)
+  })
+
+  it('keeps the code of a vault saved while the session changed from the new session', async () => {
+    const { vault, state } = await boot()
+    const save = saveVault.getMockImplementation()!
+    saveVault.mockImplementationOnce(async (request) => {
+      state.sessionEpoch.value += 1
+      return save(request)
+    })
+
+    await expect(vault.create('correct horse', true)).rejects.toThrow('changed in another browser')
+    await vault.load()
+    await vault.unlock('correct horse')
+
+    expect(vault.recoveryCode.value).toBeNull()
+  })
+
+  it('never shows a recovery code to another session, or after a reset', async () => {
+    const { vault, state } = await boot()
+    await vault.create('correct horse', true)
+    state.sessionEpoch.value += 1
+    await vault.load()
+    await vault.unlock('correct horse')
+    expect(vault.recoveryCode.value).toBeNull()
+
+    vault.lock()
+    await vault.reset()
+    await vault.create('correct horse', true)
+    // A save on another holder outlives the delete, so the keys open again after the reset.
+    deleteVault.mockImplementationOnce(async () => {})
+    await vault.reset()
+    expect(vault.state.value).toBe('locked')
+    await vault.unlock('correct horse')
+    expect(vault.recoveryCode.value).toBeNull()
+  })
+
   it('refuses to save while locked', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index c4c6ce76..cff43667 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -3,7 +3,7 @@
 // handle and is remembered in IndexedDB so one passphrase entry serves the
 // whole browser until the user locks the keys or signs out. Several heads are
 // merged once the key is known and saved with every merged head as predecessor.
-import { ref, watch } from 'vue'
+import { computed, ref, shallowRef, watch } from 'vue'
 import {
   apiErrorMessage,
   deleteVault,
@@ -73,6 +73,10 @@ const fromCache = ref(false)
  * never cached, which is a vault from before vaults moved to the holders.
  */
 const recreateNotice = ref(false)
+/** The recovery code of a vault this account and session made, in memory only, until dismissed. */
+const recovery = shallowRef<string | null>(null)
+/** The held recovery code while the vault is unlocked; a lock hides it until the next unlock. */
+const recoveryCode = computed(() => (state.value === 'unlocked' ? recovery.value : null))
 const NOTICE_PREFIX = 'aruna.vault.recreateNotice:'
 const keyStore = browserKeyStore()
 let payload: VaultPayload | null = null
@@ -200,6 +204,7 @@ function clearLocal() {
   ownKey.value = 'unknown'
   fromCache.value = false
   recreateNotice.value = false
+  recovery.value = null
   state.value = 'absent'
   loaded.value = false
   loading.value = false
@@ -516,11 +521,14 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   if (payload) throw new Error('Your provider keys are already set up.')
   requireHolderLength(passphrase)
   const run = generation
+  const session = sessionGeneration
   const target = writeTarget()
   const created = await createVault(passphrase, withRecovery)
   created.payload.keys = await rotateKeypair(created.masterKey, [])
   if (writeEnded(run, target)) throw new Error(REPLACED)
   const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, target.client)
+  // The vault exists now, so its code stays for this account and session, also past a lock.
+  if (session === sessionGeneration && target.scope === currentScope()) recovery.value = created.recoveryCode
   if (run !== generation) throw new Error(REPLACED)
   await adoptHeads(response.heads, run, created.masterKey)
   if (run !== generation) throw new Error(REPLACED)
@@ -614,6 +622,7 @@ async function reset(): Promise<void> {
   // The deletion belongs to this account and session; another one keeps its own state.
   if (session !== sessionGeneration) return
   endRunningWork()
+  recovery.value = null
   payload = null
   masterKey = null
   providers.value = []
@@ -624,6 +633,11 @@ async function reset(): Promise<void> {
   if (session === sessionGeneration) await settle(scope, response.heads)
 }
 
+/** Drops the held recovery code once the user stored it. */
+function dismissRecovery() {
+  recovery.value = null
+}
+
 async function saveProviders(next: BrowserProvider[]): Promise<void> {
   const { key } = requireUnlocked()
   const base = providers.value
@@ -668,6 +682,7 @@ export function useUserVault() {
     ownKey,
     fromCache,
     recreateNotice,
+    recoveryCode,
     load,
     create,
     unlock,
@@ -681,5 +696,6 @@ export function useUserVault() {
     openUserKey,
     whileUnlocked,
     dismissRecreateNotice,
+    dismissRecovery,
   }
 }

From 49014c57b0466bfe2bf1f951c2510d9b3a7f6269 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:17:39 +0200
Subject: [PATCH 69/86] fix: show the recovery code of new keys until the user
 stored it

---
 .../settings/VaultCreateForm.test.ts          | 16 +----
 src/components/settings/VaultCreateForm.vue   | 25 ++-----
 src/components/settings/VaultGate.test.ts     | 69 +++++++++++++++++--
 src/components/settings/VaultGate.vue         | 18 ++++-
 src/components/settings/VaultRecoveryCode.vue | 26 +++++++
 src/components/settings/VaultSettings.test.ts | 31 +++++++++
 src/components/settings/VaultSettings.vue     |  2 +
 7 files changed, 147 insertions(+), 40 deletions(-)
 create mode 100644 src/components/settings/VaultRecoveryCode.vue

diff --git a/src/components/settings/VaultCreateForm.test.ts b/src/components/settings/VaultCreateForm.test.ts
index 4258811e..b796ca99 100644
--- a/src/components/settings/VaultCreateForm.test.ts
+++ b/src/components/settings/VaultCreateForm.test.ts
@@ -31,15 +31,10 @@ const InputStub = defineComponent({
     }),
 })
 const NoticeStub = defineComponent((_, { attrs, slots }) => () => h('div', attrs, [attrs.title as string, slots.default?.()]))
-const CopyStub = defineComponent({
-  props: { value: String, label: String },
-  setup: (props) => () => h('button', { 'aria-label': props.label, 'data-copy': props.value }),
-})
 
 const VaultCreateForm = compileClientComponent(new URL('./VaultCreateForm.vue', import.meta.url), {
   vue: VueRuntime,
   '@/components/ui/Button.vue': moduleDefault(ButtonStub),
-  '@/components/ui/CopyButton.vue': moduleDefault(CopyStub),
   '@/components/ui/Input.vue': moduleDefault(InputStub),
   '@/components/ui/Notice.vue': moduleDefault(NoticeStub),
   '@/composables/useUserVault': { useUserVault: () => ({ create }) },
@@ -80,22 +75,17 @@ describe('VaultCreateForm', () => {
     expect(button(root, 'Create').props.disabled).toBe(false)
   })
 
-  it('shows the recovery code once with a copy control', async () => {
+  it('leaves the recovery code to the vault and finishes once the keys are set up', async () => {
     const { root } = await mountApp(Host)
     await fill(root, 'correct horse')
     await click(button(root, 'Create'))
 
     expect(create).toHaveBeenCalledWith('correct horse', true)
-    expect(content(root)).toContain('ABCD-EFGH')
-    expect(content(root)).toContain('shown only this once')
-    expect(element(root, (node) => node.props['data-copy'] === 'ABCD-EFGH')).toBeDefined()
-    expect(done).not.toHaveBeenCalled()
-
-    await click(button(root, 'Done'))
+    expect(content(root)).not.toContain('ABCD-EFGH')
     expect(done).toHaveBeenCalledOnce()
   })
 
-  it('finishes right away when no recovery code was asked for', async () => {
+  it('creates no recovery code when none was asked for', async () => {
     const { root } = await mountApp(Host)
     await click(element(root, (node) => node.tag === 'input' && node.props.type === 'checkbox'))
     await fill(root, 'correct horse')
diff --git a/src/components/settings/VaultCreateForm.vue b/src/components/settings/VaultCreateForm.vue
index a7d30c21..986660cc 100644
--- a/src/components/settings/VaultCreateForm.vue
+++ b/src/components/settings/VaultCreateForm.vue
@@ -1,9 +1,8 @@
 <script setup lang="ts">
-// The passphrase that seals provider keys on the node, chosen once. A
-// recovery code, when asked for, is shown here a single time.
+// The passphrase that seals provider keys on the node, chosen once. A recovery code,
+// when asked for, is shown by VaultRecoveryCode, which stays while the vault state changes.
 import { computed, ref } from 'vue'
 import Button from '@/components/ui/Button.vue'
-import CopyButton from '@/components/ui/CopyButton.vue'
 import Input from '@/components/ui/Input.vue'
 import Notice from '@/components/ui/Notice.vue'
 import { useUserVault } from '@/composables/useUserVault'
@@ -18,7 +17,6 @@ const repeat = ref('')
 const withRecovery = ref(true)
 const busy = ref(false)
 const failure = ref<string | null>(null)
-const recoveryCode = ref<string | null>(null)
 
 const tooShort = computed(() => passphrase.value.length > 0 && passphrase.value.length < MIN_KEY_HOLDER_PASSPHRASE_LENGTH)
 const mismatch = computed(() => repeat.value.length > 0 && repeat.value !== passphrase.value)
@@ -30,11 +28,10 @@ async function submit() {
   busy.value = true
   failure.value = null
   try {
-    const code = await create(passphrase.value, withRecovery.value)
+    await create(passphrase.value, withRecovery.value)
     passphrase.value = ''
     repeat.value = ''
-    if (code) recoveryCode.value = code
-    else emit('done')
+    emit('done')
   } catch (cause) {
     failure.value = errorMessage(cause)
   } finally {
@@ -44,19 +41,7 @@ async function submit() {
 </script>
 
 <template>
-  <div v-if="recoveryCode" class="space-y-3">
-    <Notice tone="success" title="Your recovery code">
-      It is shown only this once. Keep it somewhere safe: it opens your provider keys when you forget the passphrase.
-    </Notice>
-    <div class="flex items-center gap-2 rounded-md border border-border bg-muted/40 px-3 py-2">
-      <code class="min-w-0 flex-1 break-all font-mono text-xs" data-recovery-code>{{ recoveryCode }}</code>
-      <CopyButton :value="recoveryCode" label="Copy the recovery code" />
-    </div>
-    <div class="flex justify-end">
-      <Button size="sm" @click="emit('done')">Done</Button>
-    </div>
-  </div>
-  <div v-else class="space-y-3">
+  <div class="space-y-3">
     <div class="grid gap-3 sm:grid-cols-2">
       <div>
         <label class="text-xs font-medium text-foreground" for="vault-passphrase">Passphrase</label>
diff --git a/src/components/settings/VaultGate.test.ts b/src/components/settings/VaultGate.test.ts
index 6a1bc928..1aa2fba7 100644
--- a/src/components/settings/VaultGate.test.ts
+++ b/src/components/settings/VaultGate.test.ts
@@ -1,22 +1,47 @@
 import * as VueRuntime from 'vue'
-import { defineComponent, h, ref } from 'vue'
-import { beforeEach, describe, expect, it } from 'vitest'
-import { compileClientComponent, content, element, moduleDefault, mountApp } from '@/test/clientRender'
+import { defineComponent, h, ref, type App } from 'vue'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { button, click, compileClientComponent, content, element, flush, moduleDefault, mountApp } from '@/test/clientRender'
 import type { VaultState } from '@/composables/useUserVault'
 
 const state = ref<VaultState>('absent')
 const loaded = ref(true)
 const error = ref<string | null>(null)
+const recoveryCode = ref<string | null>(null)
+const dismissRecovery = vi.fn(() => {
+  recoveryCode.value = null
+})
+const vault = { state, loaded, error, recoveryCode, dismissRecovery }
+const done = vi.fn()
 
 const CreateStub = defineComponent(() => () => h('div', { 'data-create': '' }))
 const UnlockStub = defineComponent(() => () => h('div', { 'data-unlock': '' }))
+const Slotted = (tag: string) =>
+  defineComponent({ inheritAttrs: false, setup: (_, { attrs, slots }) => () => h(tag, attrs, slots.default?.()) })
+
+const VaultRecoveryCode = compileClientComponent(new URL('./VaultRecoveryCode.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@/components/ui/Button.vue': moduleDefault(Slotted('button')),
+  '@/components/ui/CopyButton.vue': moduleDefault(Slotted('span')),
+  '@/components/ui/Notice.vue': moduleDefault(Slotted('div')),
+  '@/composables/useUserVault': { useUserVault: () => vault },
+})
 
 const VaultGate = compileClientComponent(new URL('./VaultGate.vue', import.meta.url), {
   vue: VueRuntime,
   './VaultCreateForm.vue': moduleDefault(CreateStub),
+  './VaultRecoveryCode.vue': moduleDefault(VaultRecoveryCode),
   './VaultUnlockForm.vue': moduleDefault(UnlockStub),
-  '@/composables/useUserVault': { useUserVault: () => ({ state, loaded, error }) },
+  '@/composables/useUserVault': { useUserVault: () => vault },
 })
+const Host = defineComponent(() => () => h(VaultGate, { onDone: done }))
+const hosts: App[] = []
+
+async function mountHost() {
+  const mounted = await mountApp(Host)
+  hosts.push(mounted.app as App)
+  return mounted
+}
 
 function has(root: Parameters<typeof content>[0], attribute: string): boolean {
   try {
@@ -31,6 +56,13 @@ beforeEach(() => {
   state.value = 'absent'
   loaded.value = true
   error.value = null
+  recoveryCode.value = null
+  dismissRecovery.mockClear()
+  done.mockClear()
+})
+
+afterEach(() => {
+  hosts.splice(0).forEach((app) => app.unmount())
 })
 
 describe('VaultGate', () => {
@@ -52,6 +84,35 @@ describe('VaultGate', () => {
     expect(content(root)).toContain('could not be read: The node is offline.')
   })
 
+  it('shows the recovery code of the new keys and is passed only once it was stored', async () => {
+    const { root } = await mountHost()
+    expect(has(root, 'data-create')).toBe(true)
+
+    state.value = 'unlocked'
+    recoveryCode.value = 'ABCD-EFGH'
+    await flush()
+
+    expect(has(root, 'data-create')).toBe(false)
+    expect(content(root)).toContain('ABCD-EFGH')
+    expect(content(root)).toContain('Keep it somewhere safe')
+    expect(done).not.toHaveBeenCalled()
+
+    await click(button(root, 'I stored it'))
+    expect(dismissRecovery).toHaveBeenCalledOnce()
+    expect(content(root)).not.toContain('ABCD-EFGH')
+    expect(done).toHaveBeenCalledOnce()
+  })
+
+  it('is passed once the keys unlock', async () => {
+    state.value = 'locked'
+    await mountHost()
+
+    state.value = 'unlocked'
+    await flush()
+
+    expect(done).toHaveBeenCalledOnce()
+  })
+
   it('asks for the passphrase while the keys are locked', async () => {
     state.value = 'locked'
     const { root } = await mountApp(VaultGate)
diff --git a/src/components/settings/VaultGate.vue b/src/components/settings/VaultGate.vue
index 8801560b..8471d1f0 100644
--- a/src/components/settings/VaultGate.vue
+++ b/src/components/settings/VaultGate.vue
@@ -1,24 +1,36 @@
 <script setup lang="ts">
 // What stands between the user and the keys on the node: the passphrase to
 // create when there is none yet, or the one to enter while they are locked.
+import { watch } from 'vue'
 import VaultCreateForm from './VaultCreateForm.vue'
+import VaultRecoveryCode from './VaultRecoveryCode.vue'
 import VaultUnlockForm from './VaultUnlockForm.vue'
 import { useUserVault } from '@/composables/useUserVault'
 
 const emit = defineEmits<{ (e: 'done'): void }>()
-const { state, loaded, error } = useUserVault()
+const { state, loaded, error, recoveryCode } = useUserVault()
+
+// Passed once the keys are unlocked and no new recovery code waits to be stored. The forms
+// unmount when the state changes, so the gate reports it itself.
+watch(
+  () => state.value === 'unlocked' && !recoveryCode.value,
+  (passed) => {
+    if (passed) emit('done')
+  },
+)
 </script>
 
 <template>
+  <VaultRecoveryCode />
   <div v-if="state === 'absent' && loaded && !error" class="space-y-2">
     <p class="text-xs text-muted-foreground">
       Choose a passphrase. It seals the key before it reaches the node, and the node cannot read it.
     </p>
-    <VaultCreateForm @done="emit('done')" />
+    <VaultCreateForm />
   </div>
   <div v-else-if="state === 'locked'" class="space-y-2">
     <p class="text-xs text-muted-foreground">Your provider keys on this node are locked.</p>
-    <VaultUnlockForm @done="emit('done')" />
+    <VaultUnlockForm />
   </div>
   <p v-else-if="error" class="text-xs text-destructive">
     The provider keys on this node could not be read: {{ error }}
diff --git a/src/components/settings/VaultRecoveryCode.vue b/src/components/settings/VaultRecoveryCode.vue
new file mode 100644
index 00000000..48fd048a
--- /dev/null
+++ b/src/components/settings/VaultRecoveryCode.vue
@@ -0,0 +1,26 @@
+<script setup lang="ts">
+// The recovery code of a vault this session just made. It stays until the user confirms
+// storing it; a lock hides it until the next unlock.
+import Button from '@/components/ui/Button.vue'
+import CopyButton from '@/components/ui/CopyButton.vue'
+import Notice from '@/components/ui/Notice.vue'
+import { useUserVault } from '@/composables/useUserVault'
+
+const { recoveryCode, dismissRecovery } = useUserVault()
+</script>
+
+<template>
+  <div v-if="recoveryCode" class="space-y-3" data-recovery>
+    <Notice tone="warning" title="Store your recovery code">
+      Keep it somewhere safe, such as a password manager. It opens your keys if you forget the passphrase. Once you
+      confirm, it is not shown again.
+    </Notice>
+    <div class="flex items-center gap-2 rounded-md border border-border bg-muted/40 px-3 py-2">
+      <code class="min-w-0 flex-1 break-all font-mono text-xs" data-recovery-code>{{ recoveryCode }}</code>
+      <CopyButton :value="recoveryCode" label="Copy the recovery code" />
+    </div>
+    <div class="flex justify-end">
+      <Button size="sm" @click="dismissRecovery">I stored it</Button>
+    </div>
+  </div>
+</template>
diff --git a/src/components/settings/VaultSettings.test.ts b/src/components/settings/VaultSettings.test.ts
index af16876d..7369f732 100644
--- a/src/components/settings/VaultSettings.test.ts
+++ b/src/components/settings/VaultSettings.test.ts
@@ -7,6 +7,7 @@ import {
   compileClientComponent,
   content,
   element,
+  flush,
   moduleDefault,
   mountApp,
   typeValue,
@@ -16,6 +17,10 @@ import { errorMessage } from '@/lib/utils'
 
 const state = ref<VaultState>('unlocked')
 const error = ref<string | null>(null)
+const recoveryCode = ref<string | null>(null)
+const dismissRecovery = vi.fn(() => {
+  recoveryCode.value = null
+})
 const lock = vi.fn()
 const changePassphrase = vi.fn(async (_secret: unknown, _next: string) => {})
 const reset = vi.fn(async () => {})
@@ -42,6 +47,14 @@ const InputStub = defineComponent({
 const UnlockStub = defineComponent(() => () => h('div', { 'data-unlock': '' }))
 const CreateStub = defineComponent(() => () => h('div', { 'data-create': '' }))
 
+const VaultRecoveryCode = compileClientComponent(new URL('./VaultRecoveryCode.vue', import.meta.url), {
+  vue: VueRuntime,
+  '@/components/ui/Button.vue': moduleDefault(ButtonStub),
+  '@/components/ui/CopyButton.vue': moduleDefault(Passthrough),
+  '@/components/ui/Notice.vue': moduleDefault(Passthrough),
+  '@/composables/useUserVault': { useUserVault: () => ({ recoveryCode, dismissRecovery }) },
+})
+
 const VaultSettings = compileClientComponent(new URL('./VaultSettings.vue', import.meta.url), {
   vue: VueRuntime,
   '@/components/ui/Badge.vue': moduleDefault(Passthrough),
@@ -56,6 +69,7 @@ const VaultSettings = compileClientComponent(new URL('./VaultSettings.vue', impo
   '@/components/ui/Notice.vue': moduleDefault(Passthrough),
   './VaultUnlockForm.vue': moduleDefault(UnlockStub),
   './VaultCreateForm.vue': moduleDefault(CreateStub),
+  './VaultRecoveryCode.vue': moduleDefault(VaultRecoveryCode),
   '@/composables/useUserVault': { useUserVault: () => ({ state, error, lock, changePassphrase, reset }) },
   '@/lib/vault/crypto': { MIN_KEY_HOLDER_PASSPHRASE_LENGTH: 12 },
   '@/lib/utils': { errorMessage },
@@ -72,12 +86,29 @@ function dialog(root: Parameters<typeof content>[0]) {
 beforeEach(() => {
   state.value = 'unlocked'
   error.value = null
+  recoveryCode.value = null
+  dismissRecovery.mockClear()
   lock.mockClear()
   changePassphrase.mockClear()
   reset.mockClear()
 })
 
 describe('VaultSettings', () => {
+  it('shows the recovery code of keys just set up until it was stored', async () => {
+    state.value = 'absent'
+    const { root } = await mountApp(VaultSettings)
+
+    state.value = 'unlocked'
+    recoveryCode.value = 'ABCD-EFGH'
+    await flush()
+    expect(content(root)).toContain('ABCD-EFGH')
+    expect(content(root)).toContain('Keep it somewhere safe')
+
+    await click(button(root, 'I stored it'))
+    expect(dismissRecovery).toHaveBeenCalledOnce()
+    expect(content(root)).not.toContain('ABCD-EFGH')
+  })
+
   it('offers to choose a passphrase for a user who has no keys on the node', async () => {
     state.value = 'absent'
     const { root } = await mountApp(VaultSettings)
diff --git a/src/components/settings/VaultSettings.vue b/src/components/settings/VaultSettings.vue
index 485e3125..6c79dbc7 100644
--- a/src/components/settings/VaultSettings.vue
+++ b/src/components/settings/VaultSettings.vue
@@ -13,6 +13,7 @@ import DialogTitle from '@/components/ui/DialogTitle.vue'
 import Input from '@/components/ui/Input.vue'
 import Notice from '@/components/ui/Notice.vue'
 import VaultCreateForm from './VaultCreateForm.vue'
+import VaultRecoveryCode from './VaultRecoveryCode.vue'
 import VaultUnlockForm from './VaultUnlockForm.vue'
 import { useUserVault } from '@/composables/useUserVault'
 import { MIN_KEY_HOLDER_PASSPHRASE_LENGTH } from '@/lib/vault/crypto'
@@ -88,6 +89,7 @@ async function confirmReset() {
       </p>
     </header>
     <div class="px-5 py-4">
+      <VaultRecoveryCode class="mb-4" />
       <Notice v-if="error" tone="error">The provider keys on this node could not be read: {{ error }}</Notice>
       <p v-else-if="state === 'unsupported'" class="text-xs text-muted-foreground">
         This node cannot keep provider keys. Keys stay in this browser session.

From 3c4a2cb3b36e48092f9fa6756c513aeb3ae07baf Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:34:47 +0200
Subject: [PATCH 70/86] fix: drop a held recovery code once the vault carries
 another recovery block

---
 src/composables/useUserVault.test.ts | 14 ++++++++++++++
 src/composables/useUserVault.ts      | 28 +++++++++++++++++++++++++---
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 34a0030d..b19740cd 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -906,6 +906,20 @@ describe('useUserVault', () => {
     expect(vault.recoveryCode.value).toBeNull()
   })
 
+  it('drops a recovery code once the vault on the node carries another recovery block', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', true)
+    const other = await boot()
+    await other.vault.reset()
+    await other.vault.create('other horse battery', true)
+
+    await vault.load()
+    expect(vault.state.value).toBe('locked')
+    await vault.unlock('other horse battery')
+
+    expect(vault.recoveryCode.value).toBeNull()
+  })
+
   it('never shows a recovery code to another session, or after a reset', async () => {
     const { vault, state } = await boot()
     await vault.create('correct horse', true)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index cff43667..c07b3114 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -73,10 +73,15 @@ const fromCache = ref(false)
  * never cached, which is a vault from before vaults moved to the holders.
  */
 const recreateNotice = ref(false)
+/** A recovery code and the id of the saved recovery block it opens. */
+interface HeldRecovery {
+  code: string
+  block: string
+}
 /** The recovery code of a vault this account and session made, in memory only, until dismissed. */
-const recovery = shallowRef<string | null>(null)
+const recovery = shallowRef<HeldRecovery | null>(null)
 /** The held recovery code while the vault is unlocked; a lock hides it until the next unlock. */
-const recoveryCode = computed(() => (state.value === 'unlocked' ? recovery.value : null))
+const recoveryCode = computed(() => (state.value === 'unlocked' ? (recovery.value?.code ?? null) : null))
 const NOTICE_PREFIX = 'aruna.vault.recreateNotice:'
 const keyStore = browserKeyStore()
 let payload: VaultPayload | null = null
@@ -211,8 +216,20 @@ function clearLocal() {
   error.value = null
 }
 
+/** The id of a payload's recovery block: its salt and wrapped key, which a new block replaces. */
+function recoveryBlock(current: VaultPayload | null): string | null {
+  const block = current?.recovery
+  return block ? [block.salt, block.nonce, block.wrapped].join('\u0000') : null
+}
+
+/** Drops a held recovery code once the vault in place carries another recovery block. */
+function matchRecovery() {
+  if (recovery.value && recovery.value.block !== recoveryBlock(payload)) recovery.value = null
+}
+
 function unlocked(merged: Merged, key: CryptoKey) {
   payload = merged.payload
+  matchRecovery()
   predecessors = merged.revisions
   masterKey = key
   providers.value = merged.providers
@@ -267,6 +284,7 @@ async function adoptHeads(list: UserVaultHead[], run: number, key = masterKey):
     return merged.revisions.length > 1
   }
   payload = parsed[0]?.payload ?? null
+  matchRecovery()
   predecessors = parsed[0] ? [parsed[0].revision] : []
   return false
 }
@@ -282,6 +300,7 @@ async function settle(scope: string, list: UserVaultHead[]): Promise<boolean> {
     heads = []
     predecessors = []
     payload = null
+    matchRecovery()
     masterKey = null
     providers.value = []
     state.value = 'absent'
@@ -528,7 +547,10 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   if (writeEnded(run, target)) throw new Error(REPLACED)
   const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, target.client)
   // The vault exists now, so its code stays for this account and session, also past a lock.
-  if (session === sessionGeneration && target.scope === currentScope()) recovery.value = created.recoveryCode
+  if (session === sessionGeneration && target.scope === currentScope()) {
+    const block = recoveryBlock(created.payload)
+    recovery.value = created.recoveryCode && block ? { code: created.recoveryCode, block } : null
+  }
   if (run !== generation) throw new Error(REPLACED)
   await adoptHeads(response.heads, run, created.masterKey)
   if (run !== generation) throw new Error(REPLACED)

From 422e7c406409f25f5ea2b848223f33305a39d32b Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:35:12 +0200
Subject: [PATCH 71/86] fix: keep the recovery code of a vault whose save
 answer was lost

---
 src/composables/useUserVault.test.ts | 16 ++++++++++++++++
 src/composables/useUserVault.ts      |  9 +++++----
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index b19740cd..88b7c7e3 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -906,6 +906,22 @@ describe('useUserVault', () => {
     expect(vault.recoveryCode.value).toBeNull()
   })
 
+  it('shows the code of a vault whose save answer was lost once a later read finds it', async () => {
+    const { vault } = await boot()
+    const save = saveVault.getMockImplementation()!
+    saveVault.mockImplementationOnce(async (request) => {
+      await save(request)
+      throw new TypeError('network down')
+    })
+
+    await expect(vault.create('correct horse', true)).rejects.toThrow('network down')
+    await vault.load()
+    await vault.unlock('correct horse')
+
+    expect(vault.recoveryCode.value).toMatch(/^([0-9A-HJKMNP-TV-Z]{4}-){12}[0-9A-HJKMNP-TV-Z]{4}$/)
+    expect(saveVault).toHaveBeenCalledOnce()
+  })
+
   it('drops a recovery code once the vault on the node carries another recovery block', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', true)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index c07b3114..f42dbd6d 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -545,12 +545,13 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   const created = await createVault(passphrase, withRecovery)
   created.payload.keys = await rotateKeypair(created.masterKey, [])
   if (writeEnded(run, target)) throw new Error(REPLACED)
+  // Held before the save: when its answer is lost, a later read that finds this block shows it.
+  const block = recoveryBlock(created.payload)
+  const held = created.recoveryCode && block ? { code: created.recoveryCode, block } : null
+  recovery.value = held
   const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, target.client)
   // The vault exists now, so its code stays for this account and session, also past a lock.
-  if (session === sessionGeneration && target.scope === currentScope()) {
-    const block = recoveryBlock(created.payload)
-    recovery.value = created.recoveryCode && block ? { code: created.recoveryCode, block } : null
-  }
+  if (session === sessionGeneration && target.scope === currentScope()) recovery.value = held
   if (run !== generation) throw new Error(REPLACED)
   await adoptHeads(response.heads, run, created.masterKey)
   if (run !== generation) throw new Error(REPLACED)

From 818829c32918797d1650066e4c5da39b9c5afb72 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:35:53 +0200
Subject: [PATCH 72/86] fix: let the read after a vault reset yield to newer
 vault work

---
 src/composables/useUserVault.test.ts | 16 ++++++++++++++++
 src/composables/useUserVault.ts      | 10 +++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 88b7c7e3..183d998d 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -571,6 +571,22 @@ describe('useUserVault', () => {
     expect(vault.state.value).toBe('absent')
   })
 
+  it('lets the delayed read after a reset leave alone a vault created meanwhile', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    let answer!: () => void
+    readVault.mockImplementationOnce(() => new Promise((resolve) => (answer = () => resolve({ heads: [] }))))
+
+    const resetting = vault.reset()
+    await vi.waitFor(() => expect(answer).toBeDefined())
+    await vault.create('other horse battery', false)
+    answer()
+    await resetting
+
+    expect(vault.state.value).toBe('unlocked')
+    expect(remembered.size).toBe(1)
+  })
+
   it('drops an unlock that was running when a reset deleted the vault', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index f42dbd6d..54768e35 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -97,6 +97,8 @@ let inFlight: Promise<void> | null = null
 let keyCheck: Promise<void> | null = null
 /** Grows with every account or session change, unlike `generation`, which a lock advances too. */
 let sessionGeneration = 0
+/** Grows when a read, create, unlock or save starts, so an older follow-up read yields to it. */
+let vaultWork = 0
 
 function client() {
   return { baseUrl: apiBaseUrl.value, token: authToken.value }
@@ -409,6 +411,7 @@ function load(): Promise<void> {
   if (inFlight && scope === scopeKey) return inFlight
   scopeKey = scope
   const run = generation
+  vaultWork += 1
   loading.value = true
   error.value = null
   const promise = (async () => {
@@ -478,6 +481,7 @@ async function saveWithRetry(build: (current: VaultPayload) => Promise<VaultPayl
   const run = generation
   const target = writeTarget()
   requirePayload()
+  vaultWork += 1
   for (let attempt = 0; ; attempt += 1) {
     const next = await build(requirePayload())
     try {
@@ -539,6 +543,7 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   }
   if (payload) throw new Error('Your provider keys are already set up.')
   requireHolderLength(passphrase)
+  vaultWork += 1
   const run = generation
   const session = sessionGeneration
   const target = writeTarget()
@@ -565,6 +570,7 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
 async function unlockWith(open: (current: VaultPayload) => Promise<CryptoKey>) {
   const scope = requireScope()
   requirePayload()
+  vaultWork += 1
   const run = generation
   let key: CryptoKey | null = null
   let failure: unknown = null
@@ -651,9 +657,11 @@ async function reset(): Promise<void> {
   providers.value = []
   state.value = 'absent'
   forgetKey(scope)
+  const work = vaultWork
   // A save made at the same time on another holder outlives the delete.
   const response = await readVault(client())
-  if (session === sessionGeneration) await settle(scope, response.heads)
+  // A read, create, unlock or save that began meanwhile owns the state; this answer is older.
+  if (session === sessionGeneration && work === vaultWork) await settle(scope, response.heads)
 }
 
 /** Drops the held recovery code once the user stored it. */

From bc10246774fef1efa0978ae83fa20a2080d2a72b Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:36:36 +0200
Subject: [PATCH 73/86] fix: link and recheck a locked preview on the S3 issuer
 node it read from

---
 src/composables/useObjectPreview.test.ts | 23 +++++++++++++++++++++++
 src/composables/useObjectPreview.ts      | 10 ++++++++--
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/composables/useObjectPreview.test.ts b/src/composables/useObjectPreview.test.ts
index e1810f96..887eab8c 100644
--- a/src/composables/useObjectPreview.test.ts
+++ b/src/composables/useObjectPreview.test.ts
@@ -81,6 +81,29 @@ describe('preview of a locked bucket', () => {
     expect(preview.text.value).toBe('plain text')
   })
 
+  it('links and rechecks a locked bucket on the S3 issuer node when the preview omits its node', async () => {
+    activeSession.value = { ...SESSION, issuerNodeId: 'node-b' }
+    getObjectText.mockRejectedValue(LOCKED)
+    const preview = useObjectPreview()
+
+    await preview.load({ bucket: 'reef', key: 'notes.txt' })
+    expect(preview.lockedLink.value).toMatchObject({ query: { node: 'node-b' } })
+    getBucketEncryption.mockResolvedValueOnce(lockState('locked'))
+    await preview.recheck()
+    expect(getBucketEncryption.mock.calls[0][1]).toMatchObject({ baseUrl: 'https://node-b.test/api/v1' })
+
+    // Null is the connected node, whatever node the S3 session was issued by.
+    await preview.load({ bucket: 'reef', key: 'notes.txt', nodeId: null })
+    expect(preview.lockedLink.value).toEqual({
+      name: 'bucket-storage',
+      params: { bucketId: 'reef' },
+      query: { tab: 'encryption' },
+    })
+    getBucketEncryption.mockResolvedValueOnce(lockState('locked'))
+    await preview.recheck()
+    expect(getBucketEncryption.mock.calls[1][1]).toMatchObject({ baseUrl: 'https://node-a.test/api/v1' })
+  })
+
   it('keeps an ordinary refusal an error', async () => {
     getObjectText.mockRejectedValue(Object.assign(new Error('denied'), { $metadata: { httpStatusCode: 403 } }))
     const preview = useObjectPreview()
diff --git a/src/composables/useObjectPreview.ts b/src/composables/useObjectPreview.ts
index 16a554fe..3fd2199d 100644
--- a/src/composables/useObjectPreview.ts
+++ b/src/composables/useObjectPreview.ts
@@ -116,6 +116,8 @@ export function useObjectPreview() {
   /** `unknown`: the node answered without saying whether encrypted versions remain. */
   const lockCheck = ref<'idle' | 'checking' | 'still' | 'unknown' | 'failed'>('idle')
   const lockedTarget = shallowRef<PreviewTarget | null>(null)
+  /** The S3 issuer node the current load reads from when its target omits the node. */
+  let issuerNode: string | null = null
   let currentTarget: PreviewTarget | null = null
   // One controller per load: a reset cancels every probe of the load it ends.
   let probes = new AbortController()
@@ -253,6 +255,7 @@ export function useObjectPreview() {
   // Every await below is followed by a check of `id`: a newer load owns the state.
   async function load(target: PreviewTarget) {
     reset()
+    issuerNode = s3.activeSession?.value?.issuerNodeId ?? null
     const id = loadId
     currentTarget = target
     status.value = 'loading'
@@ -325,9 +328,12 @@ export function useObjectPreview() {
     }
   }
 
+  // The node a locked bucket was read from: an omitted node is the S3 issuer, null the connected node.
+  const nodeOf = (target: PreviewTarget) => (target.nodeId === undefined ? issuerNode : target.nodeId)
+
   const lockedLink = computed(() =>
     status.value === 'locked' && lockedTarget.value
-      ? bucketUnlockLink(lockedTarget.value.bucket, lockedTarget.value.nodeId)
+      ? bucketUnlockLink(lockedTarget.value.bucket, nodeOf(lockedTarget.value))
       : null,
   )
 
@@ -337,7 +343,7 @@ export function useObjectPreview() {
     if (!target || status.value !== 'locked') return
     const id = loadId
     lockCheck.value = 'checking'
-    const node = target.nodeId ?? localNodeId()
+    const node = nodeOf(target) ?? localNodeId()
     const baseUrl = node ? nodeApiBase(node) : null
     try {
       if (!baseUrl) throw new Error('The node publishes no API address.')

From 80c594cd4cfda0c7ef966adcf7a8a12d4ac35e6e Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:37:27 +0200
Subject: [PATCH 74/86] fix: say that new keys were locked when a lock ends
 their setup after the save

---
 src/composables/useUserVault.test.ts |  8 ++++++--
 src/composables/useUserVault.ts      | 17 ++++++++++++++---
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 183d998d..9955b134 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -817,7 +817,9 @@ describe('useUserVault', () => {
     const { vault } = await boot()
     onSaveHeads = () => queueMicrotask(() => vault.lock())
 
-    await expect(vault.create('correct horse', false)).rejects.toThrow('changed in another browser')
+    await expect(vault.create('correct horse', false)).rejects.toThrow(
+      'Your provider keys were set up and then locked. Unlock them to use them.',
+    )
 
     expect(vault.state.value).toBe('locked')
     expect(remembered.size).toBe(0)
@@ -899,7 +901,9 @@ describe('useUserVault', () => {
     const { vault } = await boot()
     onSaveHeads = () => queueMicrotask(() => vault.lock())
 
-    await expect(vault.create('correct horse', true)).rejects.toThrow('changed in another browser')
+    await expect(vault.create('correct horse', true)).rejects.toThrow(
+      'Your provider keys were set up and then locked. Your recovery code appears after the next unlock.',
+    )
     onSaveHeads = null
     expect(vault.recoveryCode.value).toBeNull()
     await vault.unlock('correct horse')
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 54768e35..4a6fb317 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -99,6 +99,8 @@ let keyCheck: Promise<void> | null = null
 let sessionGeneration = 0
 /** Grows when a read, create, unlock or save starts, so an older follow-up read yields to it. */
 let vaultWork = 0
+/** Grows with every lock in this tab, so a create a lock ended after its save can say so. */
+let locks = 0
 
 function client() {
   return { baseUrl: apiBaseUrl.value, token: authToken.value }
@@ -516,6 +518,7 @@ export function reapplyChange(
 
 function lock() {
   const scope = scopeKey
+  locks += 1
   // Work started before the lock belongs to the unlocked vault: none of it may open it again.
   generation += 1
   inFlight = null
@@ -546,6 +549,7 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   vaultWork += 1
   const run = generation
   const session = sessionGeneration
+  const lockCount = locks
   const target = writeTarget()
   const created = await createVault(passphrase, withRecovery)
   created.payload.keys = await rotateKeypair(created.masterKey, [])
@@ -557,9 +561,16 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, target.client)
   // The vault exists now, so its code stays for this account and session, also past a lock.
   if (session === sessionGeneration && target.scope === currentScope()) recovery.value = held
-  if (run !== generation) throw new Error(REPLACED)
-  await adoptHeads(response.heads, run, created.masterKey)
-  if (run !== generation) throw new Error(REPLACED)
+  try {
+    if (run !== generation) throw new Error(REPLACED)
+    await adoptHeads(response.heads, run, created.masterKey)
+    if (run !== generation) throw new Error(REPLACED)
+  } catch (cause) {
+    // A lock in this session after the save keeps the new vault, and its code for the next unlock.
+    if (run === generation || session !== sessionGeneration || locks === lockCount) throw cause
+    const next = held ? 'Your recovery code appears after the next unlock.' : 'Unlock them to use them.'
+    throw new Error(`Your provider keys were set up and then locked. ${next}`)
+  }
   if (noticeState(scope) === 'pending') dismissRecreateNotice()
   await rememberKey(scope, created.masterKey)
   await finishUnlock(run, false)

From 9b71fb02d385cd247340f9f92e6e31b74cf17a06 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:41:31 +0200
Subject: [PATCH 75/86] fix: keep a pending recovery code through reads sent
 before its save answered

---
 src/composables/useUserVault.test.ts | 23 +++++++++++++++++++++++
 src/composables/useUserVault.ts      | 25 +++++++++++++++----------
 2 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 9955b134..9be6a456 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -942,6 +942,29 @@ describe('useUserVault', () => {
     expect(saveVault).toHaveBeenCalledOnce()
   })
 
+  it('keeps the code of a save in flight through a read that finds no vault yet', async () => {
+    const { vault } = await boot()
+    const save = saveVault.getMockImplementation()!
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    saveVault.mockImplementationOnce(async (request) => {
+      await gate
+      await save(request)
+      throw new TypeError('network down')
+    })
+
+    const creating = vault.create('correct horse', true)
+    await vi.waitFor(() => expect(saveVault).toHaveBeenCalled())
+    await vault.load()
+    expect(vault.state.value).toBe('absent')
+    release()
+    await expect(creating).rejects.toThrow('network down')
+    await vault.load()
+    await vault.unlock('correct horse')
+
+    expect(vault.recoveryCode.value).toMatch(/^([0-9A-HJKMNP-TV-Z]{4}-){12}[0-9A-HJKMNP-TV-Z]{4}$/)
+  })
+
   it('drops a recovery code once the vault on the node carries another recovery block', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', true)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 4a6fb317..5bc356c5 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -77,6 +77,8 @@ const recreateNotice = ref(false)
 interface HeldRecovery {
   code: string
   block: string
+  /** Only a read sent after this many reads may rule the code out; none may while its save runs. */
+  settled: number
 }
 /** The recovery code of a vault this account and session made, in memory only, until dismissed. */
 const recovery = shallowRef<HeldRecovery | null>(null)
@@ -99,6 +101,8 @@ let keyCheck: Promise<void> | null = null
 let sessionGeneration = 0
 /** Grows when a read, create, unlock or save starts, so an older follow-up read yields to it. */
 let vaultWork = 0
+/** Counts the vault reads sent to the node, so a held code yields only to a read sent after its save. */
+let readsSent = 0
 /** Grows with every lock in this tab, so a create a lock ended after its save can say so. */
 let locks = 0
 
@@ -226,14 +230,14 @@ function recoveryBlock(current: VaultPayload | null): string | null {
   return block ? [block.salt, block.nonce, block.wrapped].join('\u0000') : null
 }
 
-/** Drops a held recovery code once the vault in place carries another recovery block. */
-function matchRecovery() {
-  if (recovery.value && recovery.value.block !== recoveryBlock(payload)) recovery.value = null
+/** Drops a held code once read `read`, sent after its save, finds another recovery block or none. */
+function matchRecovery(read: number) {
+  const held = recovery.value
+  if (held && read > held.settled && held.block !== recoveryBlock(payload)) recovery.value = null
 }
 
 function unlocked(merged: Merged, key: CryptoKey) {
   payload = merged.payload
-  matchRecovery()
   predecessors = merged.revisions
   masterKey = key
   providers.value = merged.providers
@@ -288,7 +292,6 @@ async function adoptHeads(list: UserVaultHead[], run: number, key = masterKey):
     return merged.revisions.length > 1
   }
   payload = parsed[0]?.payload ?? null
-  matchRecovery()
   predecessors = parsed[0] ? [parsed[0].revision] : []
   return false
 }
@@ -304,7 +307,6 @@ async function settle(scope: string, list: UserVaultHead[]): Promise<boolean> {
     heads = []
     predecessors = []
     payload = null
-    matchRecovery()
     masterKey = null
     providers.value = []
     state.value = 'absent'
@@ -418,10 +420,12 @@ function load(): Promise<void> {
   error.value = null
   const promise = (async () => {
     try {
+      const read = ++readsSent
       const response = await readVault(client())
       if (run !== generation) return
       const mergeDue = await settle(scope, response.heads)
       if (run !== generation) return
+      matchRecovery(read)
       fromCache.value = false
       recreateNotice.value = state.value === 'absent' && noticeState(scope) === 'pending'
       loaded.value = true
@@ -556,11 +560,12 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   if (writeEnded(run, target)) throw new Error(REPLACED)
   // Held before the save: when its answer is lost, a later read that finds this block shows it.
   const block = recoveryBlock(created.payload)
-  const held = created.recoveryCode && block ? { code: created.recoveryCode, block } : null
+  const held = created.recoveryCode && block ? { code: created.recoveryCode, block, settled: Infinity } : null
   recovery.value = held
-  const response = await saveVault({ payload: JSON.stringify(created.payload), predecessors: [] }, target.client)
-  // The vault exists now, so its code stays for this account and session, also past a lock.
-  if (session === sessionGeneration && target.scope === currentScope()) recovery.value = held
+  const request = { payload: JSON.stringify(created.payload), predecessors: [] }
+  const response = await saveVault(request, target.client).finally(() => {
+    if (held) held.settled = readsSent
+  })
   try {
     if (run !== generation) throw new Error(REPLACED)
     await adoptHeads(response.heads, run, created.masterKey)

From bbd5efff69b65c726b6e379eae2b282ce26e0577 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:42:10 +0200
Subject: [PATCH 76/86] fix: say that nothing was saved when a lock comes
 before the new keys are saved

---
 src/composables/useUserVault.test.ts | 20 ++++++++++++++++++++
 src/composables/useUserVault.ts      |  7 ++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 9be6a456..87ead500 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -825,6 +825,26 @@ describe('useUserVault', () => {
     expect(remembered.size).toBe(0)
   })
 
+  it('says plainly that nothing was saved when a lock comes before the save', async () => {
+    const { vault } = await boot()
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    const derive = crypto.subtle.deriveKey.bind(crypto.subtle)
+    const held = vi.spyOn(crypto.subtle, 'deriveKey').mockImplementationOnce(async (...args) => {
+      await gate
+      return derive(...args)
+    })
+
+    const creating = vault.create('correct horse', true)
+    await vi.waitFor(() => expect(held).toHaveBeenCalled())
+    held.mockRestore()
+    vault.lock()
+    release()
+
+    await expect(creating).rejects.toThrow('Your provider keys were locked before they were saved, so nothing was saved.')
+    expect(saveVault).not.toHaveBeenCalled()
+  })
+
   it('sends no new vault once the account changed while its keys were made', async () => {
     const { vault, state } = await boot()
     let release!: () => void
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 5bc356c5..8c51817f 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -557,7 +557,12 @@ async function create(passphrase: string, withRecovery: boolean): Promise<string
   const target = writeTarget()
   const created = await createVault(passphrase, withRecovery)
   created.payload.keys = await rotateKeypair(created.masterKey, [])
-  if (writeEnded(run, target)) throw new Error(REPLACED)
+  if (writeEnded(run, target)) {
+    if (session === sessionGeneration && locks !== lockCount) {
+      throw new Error('Your provider keys were locked before they were saved, so nothing was saved.')
+    }
+    throw new Error(REPLACED)
+  }
   // Held before the save: when its answer is lost, a later read that finds this block shows it.
   const block = recoveryBlock(created.payload)
   const held = created.recoveryCode && block ? { code: created.recoveryCode, block, settled: Infinity } : null

From 29fca05d336d987f682d34af6c9ff9155f54620e Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 15:44:29 +0200
Subject: [PATCH 77/86] fix: show a recovery code only while the head with its
 recovery block is unlocked

---
 src/composables/useUserVault.test.ts | 21 +++++++++++++++++++++
 src/composables/useUserVault.ts      | 10 ++++++++--
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 87ead500..1752a0f2 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -985,6 +985,27 @@ describe('useUserVault', () => {
     expect(vault.recoveryCode.value).toMatch(/^([0-9A-HJKMNP-TV-Z]{4}-){12}[0-9A-HJKMNP-TV-Z]{4}$/)
   })
 
+  it('shows a recovery code only while the head with its recovery block is unlocked', async () => {
+    const other = await boot()
+    await other.vault.create('other horse battery', false)
+    const theirs = node.heads[0]
+    node.heads = []
+    remembered.clear()
+    const { vault } = await boot()
+    const code = await vault.create('correct horse', true)
+    node.heads = [theirs, ...node.heads]
+    vault.lock()
+    await vault.load()
+
+    await vault.unlock('other horse battery')
+    expect(vault.state.value).toBe('unlocked')
+    expect(vault.recoveryCode.value).toBeNull()
+
+    vault.lock()
+    await vault.unlock('correct horse')
+    expect(vault.recoveryCode.value).toBe(code)
+  })
+
   it('drops a recovery code once the vault on the node carries another recovery block', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', true)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 8c51817f..92b8ba5d 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -82,8 +82,13 @@ interface HeldRecovery {
 }
 /** The recovery code of a vault this account and session made, in memory only, until dismissed. */
 const recovery = shallowRef<HeldRecovery | null>(null)
-/** The held recovery code while the vault is unlocked; a lock hides it until the next unlock. */
-const recoveryCode = computed(() => (state.value === 'unlocked' ? (recovery.value?.code ?? null) : null))
+/** The recovery block id of the head unlocked now. */
+const unlockedBlock = shallowRef<string | null>(null)
+/** The held code while the head with its recovery block is unlocked; otherwise hidden, not dropped. */
+const recoveryCode = computed(() => {
+  const held = recovery.value
+  return state.value === 'unlocked' && held && unlockedBlock.value === held.block ? held.code : null
+})
 const NOTICE_PREFIX = 'aruna.vault.recreateNotice:'
 const keyStore = browserKeyStore()
 let payload: VaultPayload | null = null
@@ -238,6 +243,7 @@ function matchRecovery(read: number) {
 
 function unlocked(merged: Merged, key: CryptoKey) {
   payload = merged.payload
+  unlockedBlock.value = recoveryBlock(merged.payload)
   predecessors = merged.revisions
   masterKey = key
   providers.value = merged.providers

From 703eb9a9cdca339de293e368907e69e5b6e35c9a Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 16:00:28 +0200
Subject: [PATCH 78/86] fix: drop a held recovery code only when no returned
 head carries its block

---
 src/composables/useUserVault.test.ts | 18 ++++++++++++++++++
 src/composables/useUserVault.ts      |  5 +++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index 1752a0f2..f376a918 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -1006,6 +1006,24 @@ describe('useUserVault', () => {
     expect(vault.recoveryCode.value).toBe(code)
   })
 
+  it('keeps a recovery code while a read still returns its head behind a newer one', async () => {
+    const { vault } = await boot()
+    const code = await vault.create('correct horse', true)
+    const ours = node.heads[0]
+    const other = await boot()
+    await other.vault.reset()
+    await other.vault.create('other horse battery', false)
+    node.heads = [ours, ...node.heads]
+    vault.lock()
+    remembered.clear()
+
+    await vault.load()
+    expect(vault.state.value).toBe('locked')
+    await vault.unlock('correct horse')
+
+    expect(vault.recoveryCode.value).toBe(code)
+  })
+
   it('drops a recovery code once the vault on the node carries another recovery block', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', true)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 92b8ba5d..28fb32b6 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -235,10 +235,11 @@ function recoveryBlock(current: VaultPayload | null): string | null {
   return block ? [block.salt, block.nonce, block.wrapped].join('\u0000') : null
 }
 
-/** Drops a held code once read `read`, sent after its save, finds another recovery block or none. */
+/** Drops a held code once read `read`, sent after its save, returns no head with its recovery block. */
 function matchRecovery(read: number) {
   const held = recovery.value
-  if (held && read > held.settled && held.block !== recoveryBlock(payload)) recovery.value = null
+  if (!held || read <= held.settled) return
+  if (!heads.some((head) => recoveryBlock(head.payload) === held.block)) recovery.value = null
 }
 
 function unlocked(merged: Merged, key: CryptoKey) {

From d3ef1d179969fe5e94746c7e61e66db1db61191f Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 16:01:27 +0200
Subject: [PATCH 79/86] fix: fence the read after a vault reset across every
 await of its settle

---
 src/composables/useUserVault.test.ts | 26 +++++++++++++++++++++++++-
 src/composables/useUserVault.ts      | 27 +++++++++++++++++----------
 2 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index f376a918..b931639b 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -50,6 +50,7 @@ const publishUserKey = vi.fn(async (request: { key_id: string; public_key: strin
 })
 
 // The remembered key and the cached heads, as the browser's IndexedDB would keep them.
+const rememberedLoads = vi.fn(async (scope: string) => remembered.get(scope) ?? null)
 const cachedLoads = vi.fn(async (scope: string): Promise<FakeHead[] | null> => cached.get(scope) ?? null)
 const remembered = new Map<string, CryptoKey>()
 const cached = new Map<string, FakeHead[]>()
@@ -80,7 +81,7 @@ vi.mock('@/lib/api', () => ({
 }))
 vi.mock('@/lib/vault/keyStore', () => ({
   browserKeyStore: () => ({
-    load: async (scope: string) => remembered.get(scope) ?? null,
+    load: (scope: string) => rememberedLoads(scope),
     save: async (scope: string, key: CryptoKey) => {
       remembered.set(scope, key)
     },
@@ -587,6 +588,29 @@ describe('useUserVault', () => {
     expect(remembered.size).toBe(1)
   })
 
+  it('lets a reset that waits on the browser store leave alone a vault created meanwhile', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    let release!: () => void
+    const gate = new Promise<void>((resolve) => (release = resolve))
+    let waiting = false
+    rememberedLoads.mockImplementationOnce(async (scope: string) => {
+      waiting = true
+      await gate
+      return remembered.get(scope) ?? null
+    })
+
+    const resetting = vault.reset()
+    await vi.waitFor(() => expect(waiting).toBe(true))
+    await vault.create('other horse battery', false)
+    release()
+    await resetting
+
+    expect(vault.state.value).toBe('unlocked')
+    expect(remembered.size).toBe(1)
+    expect(node.heads).toHaveLength(1)
+  })
+
   it('drops an unlock that was running when a reset deleted the vault', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 28fb32b6..0943326f 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -288,10 +288,10 @@ async function mergeHeads(list: Head[], key: CryptoKey): Promise<Merged> {
 }
 
 /** Takes what the holders returned; with a key it merges, so true means a save is due. */
-async function adoptHeads(list: UserVaultHead[], run: number, key = masterKey): Promise<boolean> {
+async function adoptHeads(list: UserVaultHead[], run: number, key = masterKey, current = () => true): Promise<boolean> {
   const parsed = parseHeads(list)
   const merged = key && parsed.length ? await mergeHeads(parsed, key) : null
-  if (run !== generation) throw new Error(REPLACED)
+  if (run !== generation || !current()) throw new Error(REPLACED)
   heads = parsed
   cacheHeads(scopeKey, list)
   if (merged && key) {
@@ -303,12 +303,13 @@ async function adoptHeads(list: UserVaultHead[], run: number, key = masterKey):
   return false
 }
 
-/** Puts what the node holds into place, opening it with a key this browser remembers. */
-async function settle(scope: string, list: UserVaultHead[]): Promise<boolean> {
+// Puts what the node holds into place, opening it with a key this browser remembers. `current`
+// must still hold after every await before the state or the cache changes.
+async function settle(scope: string, list: UserVaultHead[], current = () => true): Promise<boolean> {
   if (!list.length) {
     const run = generation
     const lost = await rememberedKey(scope) && !(await cachedHeads(scope))
-    if (run !== generation) throw new Error(REPLACED)
+    if (run !== generation || !current()) throw new Error(REPLACED)
     if (lost && noticeState(scope) !== 'seen') storeNotice(scope, 'pending')
     cacheHeads(scope, [])
     heads = []
@@ -324,16 +325,16 @@ async function settle(scope: string, list: UserVaultHead[]): Promise<boolean> {
   const key = masterKey ?? await rememberedKey(scope)
   if (key) {
     try {
-      return await adoptHeads(list, run, key)
+      return await adoptHeads(list, run, key, current)
     } catch (cause) {
       if (!(cause instanceof VaultUnlockError)) throw cause
       // A lock or session change during the merge owns the remembered key now.
-      if (run !== generation) throw new Error(REPLACED)
+      if (run !== generation || !current()) throw new Error(REPLACED)
       forgetKey(scope)
     }
   }
-  await adoptHeads(list, run, null)
-  if (run !== generation) throw new Error(REPLACED)
+  await adoptHeads(list, run, null, current)
+  if (run !== generation || !current()) throw new Error(REPLACED)
   masterKey = null
   providers.value = []
   state.value = 'locked'
@@ -689,7 +690,13 @@ async function reset(): Promise<void> {
   // A save made at the same time on another holder outlives the delete.
   const response = await readVault(client())
   // A read, create, unlock or save that began meanwhile owns the state; this answer is older.
-  if (session === sessionGeneration && work === vaultWork) await settle(scope, response.heads)
+  const current = () => session === sessionGeneration && work === vaultWork
+  if (!current()) return
+  try {
+    await settle(scope, response.heads, current)
+  } catch (cause) {
+    if (current()) throw cause
+  }
 }
 
 /** Drops the held recovery code once the user stored it. */

From 6fa65df85ae81bba8eaead6bbf0a371ea319d116 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Sun, 4 Oct 2026 16:14:06 +0200
Subject: [PATCH 80/86] fix: report a failed read after a vault reset only
 while no newer work took over

---
 src/composables/useUserVault.test.ts | 18 ++++++++++++++++++
 src/composables/useUserVault.ts      |  5 ++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/composables/useUserVault.test.ts b/src/composables/useUserVault.test.ts
index b931639b..69d4bb48 100644
--- a/src/composables/useUserVault.test.ts
+++ b/src/composables/useUserVault.test.ts
@@ -611,6 +611,24 @@ describe('useUserVault', () => {
     expect(node.heads).toHaveLength(1)
   })
 
+  it('reports no failed read after a reset once a newer read took over', async () => {
+    const { vault } = await boot()
+    await vault.create('correct horse', false)
+    let fail!: () => void
+    readVault.mockImplementationOnce(() => new Promise((_, reject) => (fail = () => reject(new Error('offline')))))
+
+    const resetting = vault.reset()
+    await vi.waitFor(() => expect(fail).toBeDefined())
+    await vault.load()
+    fail()
+
+    await expect(resetting).resolves.toBeUndefined()
+    expect(vault.state.value).toBe('absent')
+
+    readVault.mockRejectedValueOnce(new Error('offline'))
+    await expect(vault.reset()).rejects.toThrow('offline')
+  })
+
   it('drops an unlock that was running when a reset deleted the vault', async () => {
     const { vault } = await boot()
     await vault.create('correct horse', false)
diff --git a/src/composables/useUserVault.ts b/src/composables/useUserVault.ts
index 0943326f..298fc815 100644
--- a/src/composables/useUserVault.ts
+++ b/src/composables/useUserVault.ts
@@ -688,12 +688,11 @@ async function reset(): Promise<void> {
   forgetKey(scope)
   const work = vaultWork
   // A save made at the same time on another holder outlives the delete.
-  const response = await readVault(client())
   // A read, create, unlock or save that began meanwhile owns the state; this answer is older.
   const current = () => session === sessionGeneration && work === vaultWork
-  if (!current()) return
   try {
-    await settle(scope, response.heads, current)
+    const response = await readVault(client())
+    if (current()) await settle(scope, response.heads, current)
   } catch (cause) {
     if (current()) throw cause
   }

From c3ab1f9d0217fff16f96d4efdccab4ef35f71de5 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Mon, 5 Oct 2026 08:55:27 +0200
Subject: [PATCH 81/86] fix: name the storage generation in encryption changes
 and rotations

---
 .../storage/BucketEncryptionSettings.test.ts  | 20 ++++++++++++++++---
 .../storage/BucketEncryptionSettings.vue      |  2 +-
 src/lib/api/bucketEncryption.ts               |  4 +++-
 src/lib/bucketEncryption.ts                   |  4 ++--
 4 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/src/components/storage/BucketEncryptionSettings.test.ts b/src/components/storage/BucketEncryptionSettings.test.ts
index 95b6a975..a98eb58e 100644
--- a/src/components/storage/BucketEncryptionSettings.test.ts
+++ b/src/components/storage/BucketEncryptionSettings.test.ts
@@ -104,7 +104,7 @@ describe('bucket encryption settings', () => {
     expect(button(root, 'Rotate key').props.disabled).toBe(true)
   })
 
-  it('confirms a change with its notes and sends the key generation it saw', async () => {
+  it('confirms a change with its notes and sends the storage generation it saw', async () => {
     const root = await render(status({ mode: 'off', unlock: null }))
 
     await choose(root, 'Encryption mode', 'vault_locked')
@@ -118,7 +118,7 @@ describe('bucket encryption settings', () => {
       cipher: 'chacha20_poly1305',
       block_keys: 'content_derived',
       max_unlock_ms: null,
-      expected_generation: 5,
+      expected_generation: 1,
     })
   })
 
@@ -130,10 +130,24 @@ describe('bucket encryption settings', () => {
     expect(content(root)).toContain('does not invalidate an old backup')
     await click(button(dialog(root), 'Rotate'))
 
-    expect(rotate).toHaveBeenCalledWith(5)
+    expect(rotate).toHaveBeenCalledWith(1)
     expect(content(root)).toContain('Uploads to this bucket are still open')
   })
 
+  it('names the storage generation after a cipher change left the key generation as it was', async () => {
+    const root = await render(status({ unlock: UNLOCKED }))
+    await replace(status({ unlock: UNLOCKED, cipher: 'aes256_gcm', storage_generation: 2 }))
+
+    await choose(root, 'Block keys', 'unique')
+    await click(button(root, 'Save changes'))
+    await click(button(dialog(root), 'Save'))
+    await click(button(root, 'Rotate key'))
+    await click(button(dialog(root), 'Rotate'))
+
+    expect(save).toHaveBeenCalledWith(expect.objectContaining({ cipher: 'aes256_gcm', expected_generation: 2 }))
+    expect(rotate).toHaveBeenCalledWith(2)
+  })
+
   it('keeps a changed draft when the node answers again, and follows it otherwise', async () => {
     const root = await render(status({ mode: 'vault_locked', unlock: UNLOCKED }))
 
diff --git a/src/components/storage/BucketEncryptionSettings.vue b/src/components/storage/BucketEncryptionSettings.vue
index eb4316bc..aa72f9a4 100644
--- a/src/components/storage/BucketEncryptionSettings.vue
+++ b/src/components/storage/BucketEncryptionSettings.vue
@@ -102,7 +102,7 @@ function ask(action: Pending['action']) {
   pending.value = {
     action,
     draft: { ...draft.value },
-    generation: props.status.key_generation,
+    generation: props.status.storage_generation,
     notes: action === 'rotate' ? ROTATION_NOTES : notes.value,
     context: contextOf(props.status),
   }
diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index 300bacf5..52a730f6 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -89,6 +89,7 @@ export interface BucketEncryptionResponse {
   mode: EncryptionMode
   /** Stable id the bucket keys bind to; null until encryption was first enabled. */
   bucket_id: string | null
+  /** Grows with every settings change and rotation; a change or rotation names it as expected. */
   storage_generation: number
   /** Generation new writes seal to; zero until the first key exists. */
   key_generation: number
@@ -116,7 +117,7 @@ export interface PutBucketEncryptionRequest {
   block_keys?: BlockKeys
   /** Null removes the maximum; absent keeps it. */
   max_unlock_ms?: number | null
-  /** The key generation the caller saw; another current one is a 409 `stale_generation`. */
+  /** The `storage_generation` the caller saw; another current one is a 409 `stale_generation`. */
   expected_generation: number
 }
 
@@ -321,6 +322,7 @@ export function getMyCopies(
   return apiRequest(`${base(bucket)}/copies/me`, { signal, query: { generation } }, client)
 }
 
+/** `expectedGeneration` is the `storage_generation` the caller saw. */
 export function rotateBucketKey(
   bucket: string,
   expectedGeneration: number,
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 79fafa0f..5b06c0da 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -241,7 +241,7 @@ export function durationOptions(maxMs: number | null): { value: string; label: s
 const REFUSALS: Record<string, string> = {
   [ENCRYPTION_CODES.wrongKey]: 'The node says this key does not belong to the bucket.',
   [ENCRYPTION_CODES.invalidDuration]: 'The node refused this unlock length.',
-  [ENCRYPTION_CODES.staleGeneration]: 'The bucket key changed meanwhile. Read the state again and retry.',
+  [ENCRYPTION_CODES.staleGeneration]: 'The bucket settings or key changed meanwhile. Read the state again and retry.',
   [ENCRYPTION_CODES.sessionMismatch]: 'The bucket was locked or unlocked again meanwhile. Read the state again.',
   [ENCRYPTION_CODES.capacity]: 'The node holds as many unlocked buckets as it can. Lock another one first.',
   [ENCRYPTION_CODES.openUploads]: 'Uploads to this bucket are still open. Finish or abort them first.',
@@ -264,7 +264,7 @@ export function actionError(error: unknown): string {
     : encryptionError(error)
 }
 
-/** The settings an admin may change with PUT; the key generation is the one shown. */
+/** The settings an admin may change with PUT; the storage generation is the one shown. */
 export interface EncryptionDraft {
   mode: EncryptionMode
   cipher: BlockCipher

From 7001bde6d40011535daa97a785754047b3d916c5 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Mon, 5 Oct 2026 10:17:38 +0200
Subject: [PATCH 82/86] feat: show a notice when a bucket's key recovery is
 weakened

---
 src/lib/notifications.test.ts | 19 ++++++++++++++++++-
 src/lib/notifications.ts      | 22 +++++++++++++++++++++-
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/src/lib/notifications.test.ts b/src/lib/notifications.test.ts
index 8f8b1f8f..da5d4eb5 100644
--- a/src/lib/notifications.test.ts
+++ b/src/lib/notifications.test.ts
@@ -5,7 +5,7 @@ import type { ApiNotification } from '@/lib/api'
 describe('restart lock notifications', () => {
   it('opens the Encryption tab of the bucket on the node that restarted', () => {
     const notification: ApiNotification = {
-      id: 'notification-2', category: 'storage.encryption', kind: 'bucket_locked_by_restart',
+      id: 'notification-2', category: 'bucket.encryption', kind: 'bucket_locked_by_restart',
       class: 'direct', created_at_ms: 1, read: false, bucket: 'reef', node_id: 'node-b', group_id: 'group-1',
     }
     const display = describeNotification(notification, { groupName: () => undefined })
@@ -18,6 +18,23 @@ describe('restart lock notifications', () => {
   })
 })
 
+describe('recovery notifications', () => {
+  it('says the key recovery is weakened and opens the Encryption tab on the hosting node', () => {
+    const notification: ApiNotification = {
+      id: 'notification-3', category: 'bucket.encryption', kind: 'bucket_recovery_degraded',
+      class: 'direct', created_at_ms: 1, read: false, bucket: 'reef', node_id: 'node-b', group_id: 'group-1',
+    }
+    const display = describeNotification(notification, { groupName: () => undefined })
+    expect(display.title).toBe('The key recovery of reef is weakened')
+    expect(display.detail).toContain('Grant the key to another holder')
+    expect(display.link).toEqual({
+      name: 'bucket-storage',
+      params: { bucketId: 'reef' },
+      query: { tab: 'encryption', node: 'node-b', group: 'group-1' },
+    })
+  })
+})
+
 describe('join request notifications', () => {
   it('names the group and opens its Members tab', () => {
     const notification: ApiNotification = {
diff --git a/src/lib/notifications.ts b/src/lib/notifications.ts
index 8f369d72..3a3aa4fe 100644
--- a/src/lib/notifications.ts
+++ b/src/lib/notifications.ts
@@ -1,6 +1,18 @@
 import type { Component } from 'vue'
 import type { RouteLocationRaw } from 'vue-router'
-import { AlertTriangle, ArrowLeftRight, Bell, FileJson2, HardDrive, Lock, Upload, UserMinus, UserPlus, Users } from '@lucide/vue'
+import {
+  AlertTriangle,
+  ArrowLeftRight,
+  Bell,
+  FileJson2,
+  HardDrive,
+  Lock,
+  ShieldAlert,
+  Upload,
+  UserMinus,
+  UserPlus,
+  Users,
+} from '@lucide/vue'
 import type { ApiNotification } from '@/lib/api'
 import { bucketUnlockLink } from '@/lib/bucketEncryption'
 import { formatBytes, truncateMiddle } from '@/lib/utils'
@@ -112,6 +124,14 @@ export const NOTIFICATION_KINDS: Record<string, NotificationKindDescriptor> = {
     detail: () => 'A key holder must unlock it again before its data can be read.',
     link: (n) => (n.bucket ? bucketUnlockLink(n.bucket, n.node_id, n.group_id) : null),
   },
+  // Sent once to each key holder when a vault-locked bucket no longer meets the recovery rule,
+  // for example after an admin lost the role; opens its Encryption tab on the hosting node.
+  bucket_recovery_degraded: {
+    icon: ShieldAlert,
+    title: (n) => (n.bucket ? `The key recovery of ${n.bucket} is weakened` : "A bucket's key recovery is weakened"),
+    detail: () => 'Grant the key to another holder, or unlock the bucket so pending holders get their copies.',
+    link: (n) => (n.bucket ? bucketUnlockLink(n.bucket, n.node_id, n.group_id) : null),
+  },
   sync_failed: {
     icon: AlertTriangle,
     title: (n) => (n.bucket ? `Bucket sync failed for ${n.bucket}` : 'Bucket sync failed'),

From 9ba4ca7e6817b80717c3fbad3c45564d768b84d8 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Mon, 5 Oct 2026 10:21:24 +0200
Subject: [PATCH 83/86] fix: word every refusal of the encryption routes and a
 refused key change

---
 src/lib/api/bucketEncryption.ts  |  6 ++++++
 src/lib/bucketEncryption.test.ts | 17 ++++++++++++++++-
 src/lib/bucketEncryption.ts      | 12 +++++++++++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index 52a730f6..03fb94b1 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -217,6 +217,12 @@ export const ENCRYPTION_CODES = {
   confirmRecovery: 'recovery_confirmation_required',
   recoveryUnmet: 'recovery_unmet',
   capacity: 'unlock_capacity',
+  transitionRunning: 'transition_running',
+  noCopy: 'no_copy',
+  notHolder: 'not_holder',
+  notEncrypted: 'not_encrypted',
+  unchanged: 'unchanged',
+  notSupported: 'not_supported',
 } as const
 
 function base(bucket: string): string {
diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index 8d060194..b23996d1 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
-import type { BucketEncryptionResponse, BucketUnlockStatus, EncryptionTransition } from './api'
+import { ApiError, type BucketEncryptionResponse, type BucketUnlockStatus, type EncryptionTransition } from './api'
 import {
+  encryptionError,
   keyGenerations,
   changeNeedsUnlock,
   changeNotes,
@@ -43,6 +44,20 @@ const TRANSITION: EncryptionTransition = {
 }
 
 describe('bucket encryption wording', () => {
+  it('words every refusal code of the encryption routes and a refused key change', () => {
+    const refusal = (status: number, code: string) => encryptionError(new ApiError(status, 'node text', code))
+
+    expect(refusal(409, 'transition_running')).toContain('still moving to the new encryption')
+    expect(refusal(409, 'bucket_locked')).toContain('A key holder must unlock it first')
+    expect(refusal(409, 'no_copy')).toContain('You have no copy of this bucket key yet')
+    expect(refusal(403, 'not_holder')).toBe('You do not hold a key of this bucket.')
+    expect(refusal(409, 'not_encrypted')).toContain('not encrypted')
+    expect(refusal(409, 'unchanged')).toBe('The bucket already uses these settings.')
+    expect(refusal(501, 'not_supported')).toContain('does not support')
+    expect(refusal(403, 'Forbidden')).toContain('need group admin rights')
+    expect(refusal(409, 'something_new')).toBe('node text')
+  })
+
   it('names the four lock states and an unreported one', () => {
     expect(lockView(bucket(LOCKED)).label).toBe('Locked')
     expect(lockView(bucket({ ...LOCKED, lock_reason: 'restart' })).label).toBe('Locked since restart')
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 5b06c0da..af12ffd3 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -248,12 +248,22 @@ const REFUSALS: Record<string, string> = {
   [ENCRYPTION_CODES.locked]: 'The bucket is locked. A key holder must unlock it first.',
   [ENCRYPTION_CODES.recoveryUnmet]:
     'Vault-locked needs two ready key holders, or one with a recovery code.',
+  [ENCRYPTION_CODES.transitionRunning]:
+    'Stored versions are still moving to the new encryption. Try again when that has finished.',
+  [ENCRYPTION_CODES.noCopy]: 'You have no copy of this bucket key yet. Another key holder must unlock the bucket first.',
+  [ENCRYPTION_CODES.notHolder]: 'You do not hold a key of this bucket.',
+  [ENCRYPTION_CODES.notEncrypted]: 'This bucket is not encrypted, so it has no keys.',
+  [ENCRYPTION_CODES.unchanged]: 'The bucket already uses these settings.',
+  [ENCRYPTION_CODES.notSupported]: 'This node does not support this for the bucket.',
 }
 
+const NO_RIGHTS = 'You may not make this change. Settings, key holders and rotation need group admin rights.'
+
 /** A node refusal in plain words, by its code; anything else keeps the node's message. */
 export function encryptionError(error: unknown): string {
   const code = error instanceof ApiError ? (error.code ?? '') : ''
-  return REFUSALS[code] ?? apiErrorMessage(error)
+  const refused = error instanceof ApiError && error.status === 403
+  return REFUSALS[code] ?? (refused ? NO_RIGHTS : apiErrorMessage(error))
 }
 
 /** Only a 4xx says a change was not applied; a 5xx or a lost answer leaves it open. */

From 0e492d36f112e845c271880123641cd9f8d922b6 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Mon, 5 Oct 2026 10:23:00 +0200
Subject: [PATCH 84/86] fix: show a node's not_supported answer as a refusal,
 not an unconfirmed change

---
 src/lib/bucketEncryption.test.ts | 8 ++++++++
 src/lib/bucketEncryption.ts      | 6 ++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index b23996d1..f1351ba2 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { ApiError, type BucketEncryptionResponse, type BucketUnlockStatus, type EncryptionTransition } from './api'
 import {
+  actionError,
   encryptionError,
   keyGenerations,
   changeNeedsUnlock,
@@ -58,6 +59,13 @@ describe('bucket encryption wording', () => {
     expect(refusal(409, 'something_new')).toBe('node text')
   })
 
+  it('reads a 501 not_supported as a refusal and other server errors as unconfirmed', () => {
+    expect(actionError(new ApiError(501, 'node text', 'not_supported'))).toContain('does not support')
+    expect(actionError(new ApiError(503, 'node text', 'unlock_capacity'))).toContain('did not confirm this change')
+    expect(actionError(new ApiError(500, 'node text', 'Internal error'))).toContain('did not confirm this change')
+    expect(actionError(new TypeError('network down'))).toContain('did not confirm this change')
+  })
+
   it('names the four lock states and an unreported one', () => {
     expect(lockView(bucket(LOCKED)).label).toBe('Locked')
     expect(lockView(bucket({ ...LOCKED, lock_reason: 'restart' })).label).toBe('Locked since restart')
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index af12ffd3..d5d95c9d 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -266,9 +266,11 @@ export function encryptionError(error: unknown): string {
   return REFUSALS[code] ?? (refused ? NO_RIGHTS : apiErrorMessage(error))
 }
 
-/** Only a 4xx says a change was not applied; a 5xx or a lost answer leaves it open. */
+/** Only a 4xx or a 501 `not_supported` says a change was not applied; another 5xx or a lost answer leaves it open. */
 export function actionError(error: unknown): string {
-  const uncertain = !(error instanceof ApiError) || error.status >= 500
+  const unsupported =
+    error instanceof ApiError && error.status === 501 && error.code === ENCRYPTION_CODES.notSupported
+  const uncertain = !(error instanceof ApiError) || (error.status >= 500 && !unsupported)
   return uncertain
     ? 'The node did not confirm this change. The state shown is what it reports now; check it before you retry.'
     : encryptionError(error)

From 5a61bddf4510c39443564f3beb1416a331a20d9d Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Mon, 5 Oct 2026 14:32:42 +0200
Subject: [PATCH 85/86] fix: word the refusal to encrypt a bucket that holds a
 too large object

---
 src/lib/api/bucketEncryption.ts  | 1 +
 src/lib/bucketEncryption.test.ts | 3 +++
 src/lib/bucketEncryption.ts      | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/src/lib/api/bucketEncryption.ts b/src/lib/api/bucketEncryption.ts
index 03fb94b1..2b28f911 100644
--- a/src/lib/api/bucketEncryption.ts
+++ b/src/lib/api/bucketEncryption.ts
@@ -223,6 +223,7 @@ export const ENCRYPTION_CODES = {
   notEncrypted: 'not_encrypted',
   unchanged: 'unchanged',
   notSupported: 'not_supported',
+  objectTooLarge: 'object_too_large',
 } as const
 
 function base(bucket: string): string {
diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index f1351ba2..0af795b0 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -55,6 +55,9 @@ describe('bucket encryption wording', () => {
     expect(refusal(409, 'not_encrypted')).toContain('not encrypted')
     expect(refusal(409, 'unchanged')).toBe('The bucket already uses these settings.')
     expect(refusal(501, 'not_supported')).toContain('does not support')
+    expect(refusal(409, 'object_too_large')).toBe(
+      'This bucket holds an object larger than encrypted buckets support, so encryption cannot be enabled.',
+    )
     expect(refusal(403, 'Forbidden')).toContain('need group admin rights')
     expect(refusal(409, 'something_new')).toBe('node text')
   })
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index d5d95c9d..23aa7b61 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -255,6 +255,8 @@ const REFUSALS: Record<string, string> = {
   [ENCRYPTION_CODES.notEncrypted]: 'This bucket is not encrypted, so it has no keys.',
   [ENCRYPTION_CODES.unchanged]: 'The bucket already uses these settings.',
   [ENCRYPTION_CODES.notSupported]: 'This node does not support this for the bucket.',
+  [ENCRYPTION_CODES.objectTooLarge]:
+    'This bucket holds an object larger than encrypted buckets support, so encryption cannot be enabled.',
 }
 
 const NO_RIGHTS = 'You may not make this change. Settings, key holders and rotation need group admin rights.'

From 95a4b8c5ba0cd19e55d23900abdea2131ca11a23 Mon Sep 17 00:00:00 2001
From: Sebastian Beyvers <sb@pus.de>
Date: Mon, 5 Oct 2026 14:33:42 +0200
Subject: [PATCH 86/86] fix: name the size limit when a too large object blocks
 bucket encryption

---
 src/lib/bucketEncryption.test.ts | 6 ++++--
 src/lib/bucketEncryption.ts      | 5 +++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/lib/bucketEncryption.test.ts b/src/lib/bucketEncryption.test.ts
index 0af795b0..070050a1 100644
--- a/src/lib/bucketEncryption.test.ts
+++ b/src/lib/bucketEncryption.test.ts
@@ -55,8 +55,10 @@ describe('bucket encryption wording', () => {
     expect(refusal(409, 'not_encrypted')).toContain('not encrypted')
     expect(refusal(409, 'unchanged')).toBe('The bucket already uses these settings.')
     expect(refusal(501, 'not_supported')).toContain('does not support')
-    expect(refusal(409, 'object_too_large')).toBe(
-      'This bucket holds an object larger than encrypted buckets support, so encryption cannot be enabled.',
+    const limit = 'an object is larger than the 1099511627776 byte (1.00 TiB) limit of encrypted objects'
+    expect(encryptionError(new ApiError(409, limit, 'object_too_large'))).toBe(
+      'This bucket holds an object larger than encrypted buckets support, so encryption cannot be enabled. ' +
+        'An object is larger than the 1099511627776 byte (1.00 TiB) limit of encrypted objects.',
     )
     expect(refusal(403, 'Forbidden')).toContain('need group admin rights')
     expect(refusal(409, 'something_new')).toBe('node text')
diff --git a/src/lib/bucketEncryption.ts b/src/lib/bucketEncryption.ts
index 23aa7b61..c75d8bb7 100644
--- a/src/lib/bucketEncryption.ts
+++ b/src/lib/bucketEncryption.ts
@@ -264,6 +264,11 @@ const NO_RIGHTS = 'You may not make this change. Settings, key holders and rotat
 /** A node refusal in plain words, by its code; anything else keeps the node's message. */
 export function encryptionError(error: unknown): string {
   const code = error instanceof ApiError ? (error.code ?? '') : ''
+  if (code === ENCRYPTION_CODES.objectTooLarge) {
+    // The node's own message names the size limit, so it follows as a sentence.
+    const limit = apiErrorMessage(error).replace(/^./, (first) => first.toUpperCase()).replace(/[^.]$/, '$&.')
+    return `${REFUSALS[code]} ${limit}`
+  }
   const refused = error instanceof ApiError && error.status === 403
   return REFUSALS[code] ?? (refused ? NO_RIGHTS : apiErrorMessage(error))
 }