[bloodf]

Current integration checkpoint — 2026-10-21

Append-only head 51a95820e7b633f76094d173a42c8417fbda7cb6, base c07a51062913bc03469de561a8a8f29094e03382. Includes actual encrypted connection row persisted through repository and reopened in fresh process; key bytes, mtime and modes stable. Independent exact-head review passed. Trusted external FULL: 12,853 passed, 0 failed, 66 pending; lint, builds, docs/catalog, inventory and commitlint passed. Receipt 42ebb9cbcb2024c6d75fd09c65f95669070973e96818c820341967511cab4118. Pending assertions not executed. Empty baseline preserved.

Concurrent first-start processes could mint different encryption keys. Publish a complete, synced temporary key through an atomic no-clobber hard link, then use the persisted winner. Existing key bytes are never rotated or rewritten, and invalid existing keys fail explicitly.

Refs #1086.

Validation recorded on 6d7a1d6ab95bb3e8bf09868856f0e23a6cd75fc2: 15 passed, 0 failed, 0 pending across 2 selected test files, using Node 20.20.2/npm 10.8.2 on macOS arm64. Two independent processes synchronize their absent-key reads in a fresh DATA_DIR; both converge on the stable 32-byte key. Tests also cover encrypted data after restart, permissions, unchanged existing bytes/mtime, and rejection of empty/short keys. Independent source review accepted that exact head and authenticated its focused receipt.

Current candidate: 6817fc14d6b48ab8dbdb53f36929d8151fcc6424, based on main e94884312ff6651f80d13f1c862e54a916bc870e. The only later delta is the shared macOS temporary-path fixture correction in tests/unit/local-ci.test.js; production source is unchanged from the reviewed head. Earlier focused counts are not an exact-current-head full-suite result.

Current-head full checkpoint: PASS. Independently authenticated 6817fc14d6b48ab8dbdb53f36929d8151fcc6424 against main e94884312ff6651f80d13f1c862e54a916bc870e: 1,423 eligible test files in four sequential batches; 12,548 passed, 0 failed, 65 reviewed conditional skips. Skipped assertions were not executed and are not counted as passes. Root lint, production build, repository consistency checks and pinned commit-range/title lint passed; website build/docs checks passed. Receipt SHA-256: 0ea5b7f1a2db8c8e9f03b10dd1e4551d5c762963d53842238397e4317d32e6d8. Runner SHA-256: b36fdc5c0c0c1797770e49e95ab994642960be26766d865f0869a13737693bf3. Source continuity: exact first-comment normalization independently verified; all remaining bundle bytes match HEAD. The external reviewed runner reused only hash-verified independent copies of matching locked dependency installations. This is offline gate evidence; live-provider, deployment and other platform acceptance remain limited to separately recorded tests.

Executed on macOS arm64. Windows filesystem behavior was not executed; this is a platform evidence limit, not a reproduced defect.

Preserved prior PR description and historical evidence

The following is historical context; current scope and verification above supersede stale readiness, gate, dependency and environment claims. Earlier counts apply only to their named heads.

Scope

fix(crypto): publish first-start keys atomically

Related issue: #1086. Acceptance remains tracked separately.

Changed files

• src/lib/crypto/columnCrypto.js
• tests/unit/column-crypto-master-key-race.test.js

Local evidence

• Checkpoint: 9953295 committed;21 focused passed; full12320 raw0; lint passed; independent review platform assertion corrected; no merge
• Full-suite metadata: 12320 passed / 0 failed / 66 pending of 12386 (tests/.test-results.json, metadata only)
• Docs: no documentation files changed
• No baseline additions.

Status

Draft. Not integrated with other branches; CI pending. Publication commitlint gate blocked locally (missing @commitlint/config-conventional). Not ready to merge until final publication gates and CI pass.

Review readiness update — 2026-10-09

Ready for review of the stated, finished PR scope; not ready to merge. This update supersedes earlier draft/parent-only publication wording without removing the original body or user notes.

• Audited head: 9953295c4fff44fe41bec0a7a0e6b33339d51dfb; current main at audit: e51ab1c089800c2a70587822189997c482f53654.
• Required V5 Local CI: pending. No success status is published by this update.
• Merge requires actual full-CI success for the final exact head, strict up-to-date main, required reviews and resolved review threads. Any rebase or new head invalidates previous head-bound evidence.
• Missing administrator/confinement proof blocks the serial full-CI/merge path, not review readiness. No gate is waived; no build or test was run for this update.

Retained implementation evidence supports review of the stated PR scope. Historical test counts and older successful checks do not establish integration with current main or a current full-CI pass. Prior local publication notes are historical; no gates were rerun by this delivery worker.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
durindoor	Ignored	Preview	Oct 21, 2026 4:55pm UTC