PARITY: history at rest was already built — the third stale row #84

2026-09-04T20:22:02Z

paulhitt commented

2026-09-04 20:22:02 +00:00

(Migrated from gitlab.com)

Marked and implemented the whole time. Every read goes to disk:
Session.history calls Vault.history, which decrypts the record. There
is no in-memory copy to be fooled by.

Checked against iOS's E2EHistoryStore rather than assumed. Same cipher,
same posture, two honest differences recorded rather than papered over:

Android binds the RECORD NAME into the AAD, so a sealed blob cannot
be moved between slots. iOS keeps one snapshot file and does not need
that — but would, the day it splits.
iOS's .completeFileProtection is a per-file assertion. Android's
equivalent is Credential-Encrypted storage, a property of the volume
rather than of this app's request.

Neither favours one platform overall, and both clients agree on the
behaviour that matters: a plain sign-out KEEPS history, and erasing the
device destroys it — on Android by wiping every record and deleting the
Keystore key, so what is left is unopenable as well as gone.

Also recorded: Vault.history prunes expired messages on the way out,
so disappearing messages are enforced on READ rather than by a timer
nothing runs — and it rewrites the record only when something actually
expired, so a read is not a write.

Services (AIM/ICQ) retired rather than left as a gap: not a goal for this
app (owner, 2026-09-04).

That leaves only the two post-quantum rows, and the note above them
already says why they are not a gap in effect: iOS's PQ files are inert
because CryptoKit exposes ML-KEM on iOS 26 and the app targets 16, so
neither client does post-quantum anything today. Closing it properly is
one decision for both clients, not an Android task.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Marked and implemented the whole time. Every read goes to disk: `Session.history` calls `Vault.history`, which decrypts the record. There is no in-memory copy to be fooled by. Checked against iOS's `E2EHistoryStore` rather than assumed. Same cipher, same posture, two honest differences recorded rather than papered over: - Android binds the RECORD NAME into the AAD, so a sealed blob cannot be moved between slots. iOS keeps one snapshot file and does not need that — but would, the day it splits. - iOS's `.completeFileProtection` is a per-file assertion. Android's equivalent is Credential-Encrypted storage, a property of the volume rather than of this app's request. Neither favours one platform overall, and both clients agree on the behaviour that matters: a plain sign-out KEEPS history, and erasing the device destroys it — on Android by wiping every record and deleting the Keystore key, so what is left is unopenable as well as gone. Also recorded: `Vault.history` prunes expired messages on the way out, so disappearing messages are enforced on READ rather than by a timer nothing runs — and it rewrites the record only when something actually expired, so a read is not a write. Services (AIM/ICQ) retired rather than left as a gap: not a goal for this app (owner, 2026-09-04). That leaves only the two post-quantum rows, and the note above them already says why they are not a gap in effect: iOS's PQ files are inert because CryptoKit exposes ML-KEM on iOS 26 and the app targets 16, so neither client does post-quantum anything today. Closing it properly is one decision for both clients, not an Android task. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

paulhitt commented

2026-09-04 20:22:02 +00:00

(Migrated from gitlab.com)

assigned to @paulhitt

paulhitt commented

2026-09-04 20:50:13 +00:00

(Migrated from gitlab.com)

deleted the fix/node-equality-conflated-updates branch. This merge request now targets the main branch

deleted the `fix/node-equality-conflated-updates` branch. This merge request now targets the `main` branch

paulhitt (Migrated from gitlab.com) merged commit e3d0c0c121 into main

2026-09-04 20:50:22 +00:00

paulhitt commented

2026-09-09 19:01:24 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#84