v0.4.0-ev.1

Upgrading from v0.3.0-ev.1: on Linux, claude-memsync install (re-run) or claude-memsync start repairs the unit. On macOS an existing launchd agent is not rewritten; run claude-memsync stop, claude-memsync uninstall, then claude-memsync install with the same --config/--routes as before, then claude-memsync start, so the agent gets RunAtLoad.

• README for the fork: the top-level README introduces the fork, credits upstream, and covers install from a release or from integ/next, an encrypted two-machine quickstart with a join request, and Mermaid diagrams of the sync path and routing; theme-aware banners in docs/assets/; docs/fork.md gains a section on how the fork relates to upstream, and its follow-ups say which are built on integ/next; the release steps, version rules, local versioned builds and version resolution moved to docs/releases.md; docs/claude-memsync.md builds from the fork's integ/next. Fork-only.
• Routing on hosts that reach GitHub over port 443: with an ssh config HostName ssh.github.com (GitHub's ssh-over-443 endpoint), an ssh-cloned checkout now gets the route key github.com/<owner>/<repo> instead of ssh.github.com/…, so github.com/… remote rules match it, as the private-only guard already treated that host. Upgrade note: a routes.json rule or alias written with the ssh.github.com/… host no longer matches; rewrite it as github.com/…. Until then a folder recorded under the old key shows a renamed-remote or changed-remote notice (or, for a client repo, is denied) instead of syncing. Upstream candidate.
• Install re-run keeps unit arguments: a re-run claude-memsync install keeps the existing unit's ExecStart arguments and replaces only the --config/--routes given on that run (binary path refreshed), so a bare install (as the doctor/status warning suggests) can no longer drop them; a changed ExecStart prints the old and new lines and says to restart; ExecStart is matched only in [Service] and CRLF units compare equal; an unreadable unit warns "cannot read the service unit"; a symlinked unit is refused before systemctl --user disable runs. Upstream candidate.
• Autostart fix: the Linux systemd user unit is WantedBy=default.target (kardianos/service wrote multi-user.target, which a systemctl --user manager never reaches, so the daemon did not start after a reboot although the unit showed "enabled"); install (re-run) and start repair an existing unit and re-enable it (a unit counts as fine only with WantedBy=default.target and its default.target.wants link; an unreachable user manager changes nothing and prints the manual steps), a re-run install with new --config/--routes rewrites ExecStart, status and doctor warn about an unconfirmed one, and the macOS launchd agent sets RunAtLoad (kardianos/service defaults it to false, so in v0.3.0-ev.1 the agent did not start at login). Upstream candidate.
• join accept|reject|list --all: join accept <label> --all --fingerprint <fp> accepts the request from <label> in every routed repo whose fingerprint matches, in one service stop and start, with one report line per repo; any mismatching request refuses every repo (exit 1), and read-only, rekey-blocked and unencrypted repos are skipped; reject --all and list --all likewise (#1). Upstream candidate.
• identity backup: claude-memsync identity backup --store-cmd "<argv>" [--verify-cmd "<argv>"] [--identity <path> | --all | --repo <name> | --config <path>] [--dry-run] stores each age identity file this host needs (its clones', the defaults related clones read with, and the classic files rekey-pq keeps) through your password manager (the key on the command's stdin only, never printed, logged or put in an argument or the environment), reads it back with --verify-cmd and compares SHA-256 digests, and refuses a file that is not mode 0600, yours, a single hard link, a regular file (not a symlink) and an age identity (#3). With several different keys the title must carry {fingerprint} or {name} and --verify-cmd must differ for different keys, or it exits 2, and a final read-back reports an item a later store overwrote; it ends with an N stored (M verified, K UNVERIFIED, V verify-failed), F store-failed line, and turns core dumps off. Also claude-memsync version --json (and claude-memmerge version --json): one JSON line with name, version, commit, go, os, arch; the plain version text line is unchanged, any other argument exits 2, and both are documented as stable. Upstream candidate.
• Faster, selectable host bootstrap (#4): scripts/bootstrap.sh takes --project/--skip-project to choose which checkouts get a mem-project-* repo and --jobs N (default 4, max 8) to run the per-repo steps in parallel with output kept in plan order; every safety decision is a registered guard that proceeds only on positive confirmation (fault-injection tested), a half-made sync dir is moved aside after the same checks, never deleted, a missing, malformed or conflicting flag now exits 2 (usage), checked before any pause or token-file check; Ctrl-C or TERM stops the jobs and what they started, and the org token is minted once per run into a private temp dir. Fork-only.
• rekey keeps the classic identity for every related clone: a symlinked clone under the related root, and a clone whose marker cannot be examined, now count as related clones that may still use the classic identity, so recipients retire-classic keeps it (both were silently treated as not using it).

Verify every archive against SHA256SUMS before extracting; see docs/releases.md.