r-zakarya
661aac744c
They were saved only after a successful decryption, in the name of storing proven settings rather than typed ones. The consequence showed up the moment the password did not match: the URL and the token were lost on the next launch, and both had to be typed again - an API URL and forty characters of token, on a phone, on every attempt. A 200 with a container in hand already proves the address and the token. The password is a separate matter, and this call never stored it anyway. So the settings are kept there, before decryption, and the vault plus its fingerprint still wait for a decryption that actually worked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
