Keep your archive moving.

The browser is the safe account and Drive metadata surface. Private files are sealed by the trusted client before they leave your device, so the browser does not hold your only private key or send plaintext files. Do not upload personal files while the Silo preview says no uploads.

Use Python 3.11 or newer from the downloaded bundle. On Windows run .\run-silo.ps1 --selftest and .\run-silo-desktop.ps1 --selftest. On macOS or Linux run ./run-silo.sh --selftest and ./run-silo-desktop.sh --selftest. The smoke tests use temporary local state and do not contact Havre.

silo-doctor checks the server package and device gates, local key and session permissions, the registered device, and the selected sync folder. It creates no keys, changes no state, and transfers no bytes. It stays blocked until the required account and package gates are ready.

From the authenticated Silo console, choose Link a new device and copy the ten-minute command. On the new device, run python havre_remote.py silo-device setup --code <one-time-code> --name "This computer" --root ./My-Silo. The client generates its key locally, receives the device token only on that device, and starts the first encrypted push and pull. Add --collection <collection-id-or-name> when the first local mirror should be limited to one collection. Use silo-device enroll when you need enrollment without a sync. For existing private files, use the collection selector beside an active device to copy the safe grant command, then run it from an already trusted client. The browser copies the command but never performs the grant or receives a private key. Havre receives wrapper metadata, not a private key or plaintext file.

A recovery bundle is the local replacement path. Create it before a problem, protect both the bundle and its password, and import it on the replacement device. Havre is not a key escrow service. If every recipient key and recovery bundle is lost, encrypted private files cannot be decrypted by support.

The foreground watcher retries temporary failures with bounded backoff and reports when its retry budget is exhausted. Run silo-doctor first, then run silo-sync once to see the specific error. For sync after closing the companion, install the user-level background task with silo-service install.

From the downloaded bundle, run python havre_remote.py silo-service install ./My-Silo --interval-seconds 30. Linux uses a systemd user unit, macOS uses a LaunchAgent, and Windows uses a least-privilege Task Scheduler task. Use silo-service status to inspect it and silo-service uninstall to remove it. The launch definition contains the server, folder, and retry settings only. It does not contain your bearer token, device token, private key, or recovery password.

On a trusted device, run python havre_remote.py silo-collections to list safe collection metadata. In the authenticated Drive view, choose a collection from the file selector to inspect its metadata and copy the matching trusted-client sync command. Then run silo-sync ./My-Silo --collection <collection-id-or-name>, or use the same selector with silo-watch or silo-service install. The client resolves the name or id through the device credential and mounts that collection at the top of the local mirror, while retaining the full server path in local state for safe moves and deletion guards. The browser can also copy a matching collection-scoped grant command for an active target device; the command authorizes existing objects only, while future uploads still include all active devices. It does not send a bearer token or private key to the collection picker.

For an unchanged file that has completed one sync, run silo-move ./My-Silo old/path.pdf new/path.pdf. Silo preserves the file identity, encrypted object, versions, quota usage, and other devices receive a compact move event. The command refuses destination collisions and stale local edits. In the authenticated Drive view, use Move beside a folder, or run silo-move-dir ./My-Silo OldFolder NewFolder. The batch operation checks every file snapshot, refuses collisions, and retries without duplicate events.

Yes. Use New folder in the authenticated Drive view. Silo stores only a tenant-scoped folder row and sends a metadata-only folder event to trusted devices, so an empty folder does not create a zero-byte encrypted object or use storage quota. An explicit empty folder can also be moved to Trash and restored to its original path. Silo refuses to trash a folder that still contains active files or child folders, and folders inferred only from file paths cannot be deleted from the browser. Local discovery of manually-created empty directories remains display-only.

When two devices edit the same path from different base versions, Silo preserves both edits and gives the later one a visible conflict path. Review the files locally, keep the version you want, and sync the result. Silo never silently overwrites a newer remote edit.

A tracked deletion becomes a recoverable tombstone after the client checks that no newer remote change touches the path. Open Trash in the Silo console, choose the file, and restore it. Explicit empty folders have their own restore action and do not affect ciphertext or quota. Retained versions remain available while the approved retention policy is still pending.

Silo counts identical encrypted content once within the same tenant when the encryption access profile is compatible. The console shows unique physical bytes, retained logical version bytes, and tenant-local deduplication savings. Different recipients, editions, formats, and tenants stay separate.

Book intake checks metadata before a scan is uploaded. An exact tenant-local identity can link to an existing object without a second physical upload. A translation, annotation, watermark, missing page, or different format remains a separate edition or goes to review instead of being discarded.

Use the trusted client command python havre_remote.py silo-book-push ./My-Silo Scans/book.pdf. The client scans EPUB metadata, bounded local file text, and the filename before computing an opaque tenant-local identity. It can fill common EPUB title, author, and ISBN fields automatically; use --title, --author, or --isbn for image-only scans. Multiple or conflicting ISBNs stop before upload. Silo then preflights the edition and uploads encrypted bytes only for an approved new edition. An exact duplicate stops before ciphertext upload; an uncertain identity stays in review with no book bytes committed.

Public library items are references by default. Silo stores the title, creator, source URL, external identity when available, and rights declaration, but does not copy web media merely because it is reachable. A rights-cleared private file follows the encrypted upload path.

In the authenticated Silo console, choose Share link beside a rights-declared public reference. The link expires by default after 30 days and can be revoked. It shows metadata, the declared source URL, and the rights declaration. It does not expose a private encrypted file or make Havre proxy external media. The token is shown once when the link is created.

Private files are sealed with a per-file AES-256-GCM key and recipient wrappers before upload. Havre stores ciphertext and the minimum ledger metadata needed for quota, sync, versions, restore, and device authorization. Havre does not receive the plaintext private key.

Silo only opens paid storage after account mail, owner-approved CAD package prices, explicit checkout approval, renewal evidence, backup and restore evidence, and the trusted-client pilot are ready. The public readiness panel shows the current non-secret reason. A closed checkout does not create an order or charge a card.

Support covers account access, documented client defects, device-link failures, book identity decisions, quota questions, and documented restore behavior. File organization, custom migrations, rights clearance, bespoke sync configuration, and recovery of a lost-only key remain outside the support boundary.