r-zakarya
9a32fe8881
Opening from the cache derives nothing, so the key learned last session was gone and the FIRST save of every session paid the 4.5 seconds again. It now travels in the sealed blob, next to the plaintext vault and to the password that opens the container - that neighbourhood is what makes it acceptable: it exposes nothing the file does not already hold. The three parts go together or not at all. A key without its salt does not say what it fits, which makes it useless, or worse, used where it does not belong. A cache written by an earlier version carries none: LoadVault returns nil, one derivation happens, and the next write stores it. A freshly registered vault still derives once - EncryptContainer does not hand back the key it just derived. The plan records what the desktop confirmed: the two entries created on the phone imported with nothing to correct.
