r-zakarya
3392bf7c7a
Setting a code and syncing did nothing, and the log said why: "304: unchanged, vault served from cache". A sync only writes when the remote actually changed, and it is the write that re-seals - so vault.bin kept its old format and its old date, and the code looked inert. My instruction to type the code and sync was wrong; I gave it without following the path. Re-sealing belongs where the plaintext is already in hand: opening the vault. That spot has a precedent - the existing path that re-seals under authentication when a screen lock reappears - and the code now takes priority over it, since the two protections do not stack. The log also names the format it opened, so "sealed under the unlock code" can be read rather than inferred from the absence of a warning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
