Vault checkup is one list, not four chores

Claim: upkeep should be a list, not a lifestyle

Every vault accumulates the same four anxieties. A password that has been reused since 2019. A passport that expires two months before a booked flight. Two entries for the same login and no memory of which one is current. A backup that was definitely made, probably, sometime last year.

NT² Vault used to surface these in separate places: a health hint here, an expiry nudge there, a duplicate whisper somewhere else. Each one was easy to ignore precisely because it lived alone. The checkup merges them into one severity-ordered list — password health, expiry, duplicates, backup hygiene — computed on your device from ciphertext it can already see.

Nothing on the list is a surprise. That is the point. The checkup does not discover new facts about you. It collects the maintenance you were already postponing and ranks it so the scary row is on top.

What each source watches

Password health flags credentials with no password stored, reused passwords, and stale logins you have not touched in months. It reads field metadata, never keystrokes.

Expiry watches documents, insurance policies, and payment cards with dates attached. When something expires soon, the vault can suggest an expiring soon tag so the finding follows the item into search and filters.

Duplicates catch the pair you created twice — same title, two rows. Since the checkup shipped, the create flow itself warns you: saving a likely duplicate opens a hint sheet with Save anyway instead of silently forking your vault.

Backup hygiene notices when there is no recent .nt2backup and says so plainly. A vault with one copy is a vault with zero copies; the checkup is allowed to nag about exactly that.

Dismissals that stick

Every dismissible finding can be dismissed, and the dismissal is stored in your vault — not in a cookie, not in a session. Reload, lock, come back next month: the finding you handled stays handled. What reappears is genuinely new, like a document that crossed into its expiry window overnight.

The dashboard widget shows the top findings at a glance; the full list lives under Settings → Vault → Checkup, with a refresh that recomputes everything from current data.

What the checkup will never do

It will never phone home. Findings are derived locally from your encrypted items, and dismissals never leave the device except inside your own encrypted sync traffic. There is no "vault health score" sent to a server, no badge synced to a marketing email, no upsell attached to a warning. A finding is a fact about your data, shown to you, where your data lives.