put --name now accepts api-auth (JSON) and stripe-key (the raw pk_live_ key), so status failure messages can point at a working repair path instead of the setup wizard, which refuses an existing vault. The wizard also prints explicit recovery instructions when it aborts after creating the vault, and validates the site origin exactly like the web server.