Stay signed in, come back online by itself, and let a machine be given up

Three things a machine that has been set up could not do. Unlock now takes
Enter, which is the gesture everybody makes after typing a password and which
did nothing until they found the button.

Signing in survives a relaunch. The refresh token is kept in the local cache,
sealed under the vault's own cache key, so a later launch resumes the session
through the refresh grant with no browser and nobody present — and because it
is sealed under that key, only an unlocked vault can resume it. A locked
client therefore cannot reach the server at all, which is a consequence worth
stating rather than working around; docs/crypto.md §3.2 records it. Every sync
pass asks the shell for a connection rather than reading one captured at
unlock, so a laptop that unlocked on a train is online within a minute of
finding a network, with nothing pressed. Unlocking itself still never waits on
a socket.

Signing out empties this machine: the profile, the cached items, the outbox
and this machine's device key, with the account's row withdrawn when the
server can be reached. It asks first and says what it costs — the outbox count
when the vault is open, an admission that it cannot be counted when it is not,
and the shells that keep running either way. The vault is on the server and is
untouched, which is what makes the same button the only honest answer to a
forgotten passphrase, so it is on the unlock screen as well as in preferences.
It cannot end the session at the identity provider, and says so.

Two defects surfaced on the way. The synchronisation pass that runs when the
vault opens never ran at all: the loop is started from inside the unlock
command, so the busy flag it yields to was raised by that command — the first
sync was a minute late on every launch. And signing in from preferences while
unlocked threw an unlock screen over an open vault whose keys were still in
memory.

The unlock card and the new confirmation live in their own controls because
MainWindow cannot be laid out headless, so markup left inside it is markup no
test can measure; both are now measured at the window's minimum size in the
shapes that grow. What is still unverified is the composed window itself.

docs/crypto.md

@@ -193,6 +193,16 @@ moment to discard it.
 The label is versioned, so a client holding a v1 cache fails to open it and re-pulls rather than
 decrypting to nonsense. That is the whole reason for bumping rather than reusing the label.
 
+**What it seals, and the one entry that is not vault content.** Three kinds of record: the plaintext
+columns the server needs, the values a merge overrode, and — added 2026-07-31 — the OIDC **refresh
+token** this machine may resume its sign-in with, bound as `LocalCache(User, userId)`. The third is
+different in kind from the other two: it is a credential for the *account*, not for the vault, and
+sealing it here is a deliberate choice about what a stolen cache file is worth. A refresh token kept in
+the clear beside the ciphertext would let a copied profile reach the server as its owner without the
+passphrase ever being guessed; under this key it can only be read by a process that has already opened
+the vault. The cost is stated rather than worked around: **a locked client cannot reach the server at
+all**, because the token it would present is behind the same lock as everything else.
+
 ### Why the bundle is wrapped many ways
 
 This is the load-bearing structural choice. Because every wrap protects the *same* bundle:

docs/design-import-gaps.md

@@ -153,8 +153,14 @@ Nothing on this screen exists. It is in the nav rail and reaches a screen that s
 
 ## Preferences
 
-The screen ships with what is real — this machine's device key, locking, and syncing — and lists the rest
-as absent rather than omitting it silently.
+The screen ships with what is real — this machine's device key, locking, syncing, and signing out — and
+lists the rest as absent rather than omitting it silently.
+
+> **Signing out is not on the design and is here anyway.** The design has no way to leave a machine, and
+> without one there is no way to hand a laptop on, to enrol a second account, or to get past a forgotten
+> passphrase — which is unrecoverable by construction, so the unlock screen would otherwise be a dead end.
+> It empties the local cache and withdraws the device key from the account; it cannot end the session at the
+> identity provider, and says so.
 
 | Design element | Layer | What it would take |
 | --- | --- | --- |