r-zakarya
d472dd4ef8
The retry I added yesterday never fired, and could not: the public key is rebuilt through KeyFactory, so it is an ordinary RSA key with no link to the Keystore. It encrypts perfectly well while its private half is permanently invalidated. The re-seal therefore sealed the cache with a key nothing would ever open again - the app asked for the sync password instead of the pattern. Invalidation is observable at exactly one moment: reading with the private key. LoadVault now drops the alias when the system names the cause, so the next write mints a fresh pair instead of sealing another unopenable file. And the caller that re-seals a plain cache asks for a fresh key outright: protection reappearing on the device is precisely the event that invalidated the old one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
