r-zakarya
e4a50df64d
After the screen lock was removed and put back, the app stopped asking for the pattern. Two gaps, both mine. The cache had been rewritten while the device had no lock, so under the plain key - and nothing ever moves it back. Protection was decided at write time only, and a write happens only when a new snapshot arrives; a 304 left the file in the clear indefinitely. It is now re-sealed on open, where the plaintext is already in hand. And the invalidated RSA key was never replaced. Removing a lock, or enrolling a new fingerprint, permanently invalidates a protected key while its alias survives. EnsureWrapKey only created the pair when the alias was absent, so it kept reusing a dead key: every encryption failed and every write fell back to the plain key, forever. It now deletes and regenerates on a second attempt. Measured on device: header 1 before, 3 after the first launch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
