Keep your archive moving.

The browser is the safe account and Drive metadata surface. Private files are sealed by the trusted client before they leave your device, so the browser does not hold your only private key or send plaintext files. Do not upload personal files while the Silo preview says no uploads.

Use Python 3.11 or newer from the downloaded bundle. On Windows run .\run-silo.ps1 --selftest and .\run-silo-desktop.ps1 --selftest. On macOS or Linux run ./run-silo.sh --selftest and ./run-silo-desktop.sh --selftest. The smoke tests use temporary local state and do not contact Havre.

silo-doctor checks the server package and device gates, local key and session permissions, the registered device, and the selected sync folder. It creates no keys, changes no state, and transfers no bytes. It stays blocked until the required account and package gates are ready.

On the new device, run silo-device register with a distinct name. From an existing active device, run silo-device grant --id followed by the target device id. The existing device unwraps and re-wraps file keys locally. Havre receives wrapper metadata, not a private key or plaintext file.

A recovery bundle is the local replacement path. Create it before a problem, protect both the bundle and its password, and import it on the replacement device. Havre is not a key escrow service. If every recipient key and recovery bundle is lost, encrypted private files cannot be decrypted by support.

The foreground watcher retries temporary failures with bounded backoff and reports when its retry budget is exhausted. Run silo-doctor first, then run silo-sync once to see the specific error. For sync after closing the companion, install the user-level background task with silo-service install.

From the downloaded bundle, run python havre_remote.py silo-service install ./My-Silo --interval-seconds 30. Linux uses a systemd user unit, macOS uses a LaunchAgent, and Windows uses a least-privilege Task Scheduler task. Use silo-service status to inspect it and silo-service uninstall to remove it. The launch definition contains the server, folder, and retry settings only. It does not contain your bearer token, device token, private key, or recovery password.

For an unchanged file that has completed one sync, run silo-move ./My-Silo old/path.pdf new/path.pdf. Silo preserves the file identity, encrypted object, versions, quota usage, and other devices receive a compact move event. The command refuses destination collisions and stale local edits. In the authenticated Drive view, use Move beside a folder, or run silo-move-dir ./My-Silo OldFolder NewFolder. The batch operation checks every file snapshot, refuses collisions, and retries without duplicate events.

When two devices edit the same path from different base versions, Silo preserves both edits and gives the later one a visible conflict path. Review the files locally, keep the version you want, and sync the result. Silo never silently overwrites a newer remote edit.

A tracked deletion becomes a recoverable tombstone after the client checks that no newer remote change touches the path. Open Trash in the Silo console, choose the file, and restore it. Retained versions remain available while the approved retention policy is still pending.

Silo counts identical encrypted content once within the same tenant when the encryption access profile is compatible. The console shows unique physical bytes, retained logical version bytes, and tenant-local deduplication savings. Different recipients, editions, formats, and tenants stay separate.

Book intake checks metadata before a scan is uploaded. An exact tenant-local identity can link to an existing object without a second physical upload. A translation, annotation, watermark, missing page, or different format remains a separate edition or goes to review instead of being discarded.

Public library items are references by default. Silo stores the title, creator, source URL, external identity when available, and rights declaration, but does not copy web media merely because it is reachable. A rights-cleared private file follows the encrypted upload path.

In the authenticated Silo console, choose Share link beside a rights-declared public reference. The link expires by default after 30 days and can be revoked. It shows metadata, the declared source URL, and the rights declaration. It does not expose a private encrypted file or make Havre proxy external media. The token is shown once when the link is created.

Private files are sealed with a per-file AES-256-GCM key and recipient wrappers before upload. Havre stores ciphertext and the minimum ledger metadata needed for quota, sync, versions, restore, and device authorization. Havre does not receive the plaintext private key.

Silo only opens paid storage after account mail, owner-approved CAD package prices, explicit checkout approval, renewal evidence, backup and restore evidence, and the trusted-client pilot are ready. The public readiness panel shows the current non-secret reason. A closed checkout does not create an order or charge a card.

Support covers account access, documented client defects, device-link failures, book identity decisions, quota questions, and documented restore behavior. File organization, custom migrations, rights clearance, bespoke sync configuration, and recovery of a lost-only key remain outside the support boundary.